An administrator does not want to report the logon events of service accounts to FortiGate. What setting on the collector agent is required to achieve this?

Adding NTLM authentication support is a setting related to the authentication protocol used by the Collector Agent, not a mechanism to filter which user logon events are reported.

Adding user accounts to Active Directory (AD) is a prerequisite for user management and for the Collector Agent to detect logons, but it is not a setting on the agent to ignore specific accounts from being reported.

The 'FortiGate group filter' (likely referring to group-based filtering on the FortiGate or Collector Agent) is for managing groups, while the question specifically asks about ignoring individual user accounts from being reported by the agent.

The FortiGate Collector Agent has a configurable 'Ignore User List' (or similar feature) where specific user accounts, such as service accounts, can be added to prevent their logon events from being collected and reported to the FortiGate, reducing irrelevant log data.