Troubleshooting Tip: Netlogon service crashes after FortiClient TS Agent upgrade on RDS servers

Description

This article describes the steps to upgrade the FortiClient TS Agent on Remote Desktop Session Host (RDSH) servers. The Netlogon service terminates during the RDS service start‑up sequence.

Scope

FortiGate, FSSO.

Solution

The RDS servers are rebooted monthly after installing Windows updates.

After each reboot, the Netlogon service crashes, resulting in multiple issues, such as:

• Failure to contact Active Directory results in LDAP bind errors and broken Group Policy processing.

• Windows Time Service (W32Time) cannot synchronise, resulting in time‑drift issues.

• New log‑on attempts are denied because Netlogon cannot authenticate the user.

The System event logs record the error as follows:

Event ID 5820 – Netlogon
The Netlogon service could not add the AuthZ RPC interface.
The service was terminated. The following error occurred:
"The endpoint is a 'duplicate'.

Manually restarting the Netlogon service restores normal operation; however, the issue reoccurs after the next scheduled reboot of the RDS servers.

FortiClient’s TS/DCAgent registers an AuthZ RPC interface that duplicates the Netlogon RPC endpoint (nlrpc). Windows detects the duplicate registration and aborts Netlogon with error 5820. The issue is tracked internally under 1261587.

Workaround:

• Reboot the server.

• After Windows finishes booting and Netlogon starts, start the FortiClient service manually:
  
  

net start "FortiClient Service Scheduler"

• This avoids the duplicate RPC registration occurring before Netlogon is up.

Permanent fix:

• Fortinet released a corrected build (≥ v5.0.0331) that removes the duplicate RPC registration.

• Download the latest TS Agent from the Fortinet Support Portal (requires a support account).

• Deploy the updated agent to all RDSH and DC servers.

• Reboot and confirm Netlogon no longer crashes.