Admin account shows as source on Forward Traffic logs

[suzuki_todd]

I was looking at the forward traffic logs on our firewall and I saw one of our administrator accounts was listed as the source for a particular endpoint. The admin was not logged in, only one user was currently logged in, computer has been rebooted a number of times since I first saw this and this admin account is still linked as the source for this computer.

The source entry appears to get its information from FortiClient?

[johnathan]

How are you doing authentication on your firewall; did the user have to authenticate before being allowed to generate traffic? Any FSSO? Is the user connected via VPN?