Endpoint policies in EMS are evaluated top-to-bottom; the first policy whose conditions all match is applied.

The “Training” policy is placed above “Sales” and contains two conditions:

1. User = student

2. AD Domain = trainingAD.

The account “student” logging in from a machine joined to trainingAD satisfies both conditions, so EMS immediately assigns the Training policy and stops further evaluation. Therefore only the Training policy is pushed to that endpoint.

A. Sales is lower in the list; evaluation stops once Training matches, so Sales is ignored.

C. The Default policy is applied only if no other policy matches; Training matches, so Default is not used.

D. Policy evaluation does not split on/off-fabric once a higher rule matches; Training alone is assigned.

1. Fortinet, “FortiClient EMS 7.4 Administration Guide,” Sec. “Policy evaluation order,” p. 93.

2. Fortinet, “FortiClient EMS 7.4 Administration Guide,” Example-2 “Selecting policy based on user and domain,” p. 95.