Skip to main content
arleniscg
Staff
arleniscg
Staff
March 12, 2025

Troubleshooting Tip: FortiEDR on AD working as FSSO Collector Agent/DC Agent causes the number of login users not to increase

  • March 12, 2025
  • 0 replies
  • 61927 views

Description

This article describes the troubleshooting steps if, after installing FortiEDR on an Active Directory server, also working as a FSSO Collector Agent/DC Agent for SSO authentication with FortiGate, on the collector if FortiEDR is running, the number of logon users does not increase. 

Scope

FortiEDR, FortiGate.

Solution

FortiEDR is running on the server of the FSSO Collector Agent.

  1. Create an exclusion on the EDR manager for the AD Collector Agent Server path:

 

EDR.png

 

Path to exclude on EDR Manager: \Program Files\Fortinet\FSAE\*.

 

  1. Validate the AD Collector Agent Server is properly configured: 

  • The FSSO user has the required privileges under this account. 

 

permisos.png

 

  • If the Collector working in DC Mode validates Advanced Settings -> Event IDs to poll=2.

 

EDR 02.png

 

  • Validate that all DC agent servers are enabled to send logs to this affected Collector Agent Server.  

 

EDR 01.png

 

  1. If the issue continues, change FortiEDR Collector NetworkMonitoring settings to work with TDI. By default, this configuration is set to WFPl  'NetworkMonitoringMode':'WFP'. To manually perform this change, follow the steps below:

  • Stop the collector service. Execute the following command in the CLI:

"C:\Program Files\Fortinet\FortiEDR\FortiEDRCollectorService.exe" --stop -rp:<pasword>


  • Execute Notepad as Administrator and open the file below:

C:\ProgramData\FortiEDR\Config\Collector\CollectorBootstrap.jsn


  • Search for 'NetworkMonitoringMode' and change it to 'NetworkMonitoringMode':'TDI'.

  • Save the file.

  • Start the Collector Service. Execute the following command in the CLI:

"C:\Program Files\Fortinet\FortiEDR\FortiEDRCollectorService.exe" --start

 

  • Restart the device.

 

  1. Monitor the number of log-on users on the AD Collector agent server. If the problem is still present, open a case with the Fortinet TAC Team


Note: To make this change, 'NetworkMonitoringMode':'TDI' permanent on the device, open a case with the Fortinet TAC Team.


  • FortiEDR is running on the server of the FSSO DC Agent.

Since the DC Agent installer installs a DLL in the system32 folder, a DLL which is called by the system process named lsass.exe, excluding the \Program Files\Fortinet\FSAE\* path on EDR Manager will not make a difference in this case.

 

For this situation, there are two options:

  1. Perform the same steps as described before:

Stop the collector service.

Run Notepad as an administrator and open:

 C:\ProgramData\FortiEDR\Config\Collector\CollectorBootstrap.jsn.


  • Search for 'NetworkMonitoringMode' and modify it as 'NetworkMonitoringMode':'TDI'.

  • Save the file.

  • Start  Collector Service.

  • Restart the device.

 

  1. Configure the DC Agent for using SSL Mode (TCP port 8003).

 

Related articles:

      Terms & ConditionsAccessibility statement