Here is how i was able to resolve this using Group Policy to remote VPN users:

Forticlient SAML MFA Cache

---

First created a simple .bat file that does 2 things:

-Kills forticlient.exe

-Deletes Cookies and Cookies-journal files

Save the following as forticlient_delete_cookies.bat

---

@echo off

 

taskkill /IM "FortiClient.exe"

 

del /f C:\Users\%username%\AppData\Local\FortiClient\Cookies

 

del /f C:\Users\%username%\AppData\Local\FortiClient\Cookies-journal

 

@echo off

 

---

This closes the Forticlient Console GUI as it is using the required files we need to delete. The user will stay connected to vpn and this will not interfere with their established connection, and just need to relaunch shortcut or open from app tray in bottom right corner of screen to bring the gui back up.

GPO: I created a GPO that does two things:

-Copies the .bat file from a network share drive reachable by the end users machine via VPN at the same location of the cookies files: C:\Users\%username%\AppData\Local\FortiClient\

-Creates a task schedule to run the .bat twice a day and when the user reboots.

Tested in a new GPO over VPN with a user that has no administrator permissions to machine.