Chapter 3 Authentication for FortiOS 5.0 : Users and user groups : Users : Monitoring users
  
Monitoring users
To monitor user activity in the web-based manager, go to User & Device > Monitor > Firewall. The list of users who are logged on is displayed with some information about them such as their user group, security policy ID, how long they have been logged on, their IP address, traffic volume, and their authentication method as one of FSSO, NTLM, or firewall (FW-auth).
From this screen you can de-authenticate all users who are logged on. The de-authenticate button is at the top left of this screen.
To see information about banned users go to User & Device > Monitor > Banned User. Displayed information about users who have been banned includes what application the triggered the ban (Application Protocol), the reason for the ban (Cause or rule), Created, and when the ban expires.