Let’s settle the debate: Which Sangfor SSO method actually works best in a messy, real-world AD environment?

The library says Script Mode has the highest success rate, but IWA SSO offers that 'zero-touch' magic using NTLM/Kerberos. We also have the SSO Agent, which doesn't require AD changes but can't always sync logouts effectively.
Discussion Points:

• In your experience, which mode is the most 'stable' when dealing with remote users or VPNs?
• Have you ever had to fall back to the DKEY pendrive for ultra-secure, audit-free users?
• What’s the one 'gotcha' you found when setting up IWA in IE or Chrome?"
  

If the environment is large, has multiple sites, VPN users, VDI, terminal servers, and a mix of Windows versions, Script Mode is usually the most forgiving.

The DKEY approach still has its place.

Typical use cases:
Administrators, Finance departments, Industrial control systems, Highly regulated environments, Shared workstations

Its biggest advantage is that authentication is tied to possession of the device rather than browser sessions or AD state.

Browser does not trust the IAG URL as an intranet site