report or show FSSO login on computers

[jamestiberius]

so we are using FSSO, works good, have multiple groups that are: no internet, restricted internet , less restricted, and unrestricted, basically.

someone who has no internet as been seen on facebook, I tested the policy for that profile, and facebook is blocked.

HOWEVER - when a user without internet access clicks on their web browser, they get the fortinet signon, and I have a suspicion that someone who has internet access gave that person their signon information.

so is there a way I can see each signon as it occurs, or what systems it occured on so I can track instances like this?

I can look at the single signon agent on the server, and see who all is authenticated right now, but that does not help me see in this instance, as they have not been back on facebook the last couple of days.