Strengths: Simple setup; no separate CA host required.

Limitations: Typically supports only a limited number of monitored DCs and has no user logout monitoring in that scenario.

What it is: Install DC Agent on every DC + a Collector Agent (usually not on the DC if you want to isolate resources).

Why choose it: Fortinet calls this recommended for large user environments due to scalability/performance, and it’s considered very reliable for capturing logons.

Tradeoffs: Requires installs + typically reboots after DC Agent install, plus ongoing maintenance on all DCs.

Comms (useful detail): The CA communicates with FortiGate over TCP/8000, and DC/TS agents commonly use UDP/8002 to update the CA.

This is a common exam gotcha because it affects group resolution and filtering.

Standard mode

Group/user format is simpler (e.g., DOMAIN\user).

Often used when you want easier group handling and/or when LDAP access constraints exist.

Advanced mode

Uses LDAP Distinguished Name style group info (DN) and enables better parsing, including nested groups (a major real-world reason to use it).

Fortinet notes that certain group-filter designs and integrations require Advanced mode in practice.