FSSO Collector Agent Event Dropouts on Windows Server 2022 Domain Controllers
Remote WMI and WinAPI event log polling latency on Microsoft Windows Server 2022 Domain Controllers causes the Fortinet Single Sign-On (FSSO) Collector Agent to drop Security Event ID 4624 records during peak logon bursts, stranding legitimate corporate users in unauthenticated guest states.
Technical Root Cause Analysis
The Fortinet Single Sign-On (FSSO) Collector Agent monitors Windows Active Directory Domain Controllers to build real-time IP-to-User identity mappings. When configured in WMI Polling Mode or WinAPI Polling Mode against Windows Server 2022, the agent initiates periodic RPC queries over TCP port 135 / dynamic RPC ports to parse the Windows Security Event Log for Event ID 4624 (Successful Logon).
Windows Server 2022 enforces stricter DCOM concurrency controls, RPC connection limits, and enhanced security log filtering overhead. During 08:30–09:30 morning peak logon surges, the Collector Agent's synchronous WMI query worker threads encounter remote RPC latency exceeding 4,500ms. As the internal event buffer overflows, older logon events are skipped without retry. Consequently, the FortiGate authd daemon receives no logon notification for these endpoints, categorizing active workstations as unauthenticated traffic and breaking identity-based firewall policies.
Affected Firmware & Blast Radius Matrix
| Component / Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FSSO Collector Agent | v5.0.0300 – v5.0.0312 | v5.0.0315+ | Switch from WMI Polling to native DCAgent DLL |
| FortiOS 7.2 | 7.2.0 – 7.2.6 | 7.2.7+ | Tune authd cache timers and enable LDAP group lookup |
| FortiOS 7.4 | 7.4.0 – 7.4.2 | 7.4.3+ | Enable asynchronous FSSO agent polling |
| FortiOS 7.0 | 7.0.6 – 7.0.14 | 7.0.15+ | Deploy redundant Collector Agents in DC Agent mode |
Platform Impact: Affects all FortiGate models operating in identity-based policy environments with Active Directory domains running on Windows Server 2022 domain functional levels.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands directly on your FortiGate firewall to inspect the current state of FSSO Collector Agent connectivity and determine if user logon entries are missing:
Diagnostic Commands
# 1. Inspect the active FSSO Collector Agent status and session count
diagnose debug authd fsso summary
# 2. Search for a specific affected workstation IP address in the local FSSO table
diagnose debug authd fsso list | grep -B 2 -A 4 "10.10.104.55"
# 3. Check memory and active worker status of the FortiOS authentication daemon
diagnose test application authd 1
# 4. Verify FSSO Collector Agent socket connection health
diagnose debug authd fsso server-statusRemediation & Workaround Steps (Teaser Preview)
Access the complete verified operational workflow inside the interactive Ferrite platform:
Frequently Asked Questions
Windows Server 2022 enforces stricter DCOM RPC concurrency constraints and aggressive security event log throttling. Synchronous WMI queries back up during morning login spikes, dropping events before reaching FortiOS authd.
Users successfully log into domain machines but are treated as unauthenticated guests by the firewall, triggering policy denials or unwanted captive portal prompts.
Migrate from remote WMI polling to native DCAgent mode on the Domain Controllers or upgrade the FSSO Collector Agent to version 5.0.0315+ with asynchronous event log collection.