Technical Tip: How to Uninstall FortiEndPoint components from Endpoint to free up licenses

1. Create a Workgroup on FortiClient EMS, which will be used in a Deployment to carry out the uninstallation task. In this example, it has been created a Workgroup named 'Uninstall'.

Steps: Login to Cloud FortiClientEMS -> Endpoints -> Workgroups -> 'Right Click' 'All Groups' -> Create group named 'Uninstall'.

2. Configure a new Deployment to perform Uninstallation.

Steps: Login to Cloud FortiClientEMS -> Deployment & Installers -> Manage Deployment -> Add -> Name it accordingly -> Edit Endpoint and Groups.

Assign Workgroup 'Uninstall' configured in the above step to it: Select Action Uninstall -> Depending upon business requirement, it is possible to perform an attended or unattended installation. In this example, perform the Attended installation where user is going to get a prompt to Uninstall the FortiClient which also includes FortiEDR.

3. Move the endpoint to the Workgroup 'Uninstall' from which the FortiEndpoint agent needs to be removed.

Steps: Login to Cloud FortiClientEMS -> All Endpoints -> Select the required Endpoint/Endpoints -> Move to Group 'Uninstall'.

4. The Endpoint will receive a prompt as shown below. As soon as the user selects Remove Now, FortiEndPoint components (FortiClient and FortiEDR) get uninstalled and the endpoint will be rebooted.

Note: Excluding an Endpoint from FortiClient EMS would free up FortiClient license. However, the EDR license is still going to be consumed. In such scenarios, to free up the EDR license, the FortiEDR Collector agent needs to be manually uninstalled.

Windows.

1. Stop the service using the command 'C:\Program Files\Fortinet\FortiEDR\FortiEDRCollectorService.exe' --stop -rp:INPUTPASSWORD.
2. Uninstall FortiEDR Collector Agent.

Technical Tip: How to uninstall FortiEDR Windows Collector with msiexec using product ID GUID 

MacOS & Linux:

Uninstalling FortiEDR Collectors - FortiEDR 6.2.0 administration guide

If there are still any problems encountered, open a new technical support ticket for further assistance: Support Fortinet. 

Attached FortiClient logs (Diagnostic Tool output .cab ). The diagnostic tool can be executed from the FortiClient About page.

Path-Win: User\AppData\Local\FortiClient\tmp\Diagnostic_Result

Path-MacOS: cd /Library/Application\ Support/Fortinet/FortiClient/Logs

Related Article:

Technical Tip: What to provide when opening a FortiEndpoint ticket with TAC