Technical Tip: How to De-register or Un-register Forticlient

Description

This article describes how to de-register or un-register FortiClient in FortiOS.

On earlier FortiOS releases, the FortiClients needed to register directly with the FortiGate for endpoint control. 

Scope

FortiGate 6.1 and earlier, FortiClient.

Solution

Under Monitor -> FortiClient Monitor, select the PC to be unregistered or blocked. Right-click and select the appropriate action of either 'Block' to prevent FortiClient from connecting or 'Unregister' to de-register. 

Similarly, it is possible to run the diagnose commands from the CLI:

Note 1: In FortiOS 6.2.0 and above, the feature described above was deprecated. FortiClient EMS became the mandatory and standard method for endpoint compliance, management and provisioning.

Note 2: Modern workflow (recommended):

• FortiGate 6.2+ / 7.x: FortiClient EMS is the standard control plane for endpoint registration, compliance and provisioning.
• The operator actions are done in EMS and/or on the endpoint (FortiClient), not 'pushed' by FortiGate.

Related documents:

• Disconnecting and connecting endpoints
• Technical Tip: Differences between 'De-register' and 'Exclude from Management'

Note 3: If 'Deregister' seems to do nothing:

EMS applies deregister on the next telemetry communication. If the endpoint is offline, blocked, or telemetry cannot reach EMS, the endpoint may not process the deregister until it reconnects.

If the objective is to prevent future reconnection:

'Deregister' disconnects and removes configuration, but the endpoint can typically re-establish telemetry depending on the enrollment and policy controls. Consider additional EMS controls (profiles, certificates, quarantine, etc.) based on security requirements.