FortiClient EMS 8.0 + Intune Deployment - MST configuration not being applied (Invitation Code prompt)

2 replies
237 views

Hi Fellas,

I'm deploying FortiClient EMS 8.0 using Microsoft Intune (Win32 app) and have run into an issue.

Environment

FortiClient EMS 8.0.x
Microsoft Intune (Win32 app)
Deployment package generated from EMS with MSI Installer Files enabled
EMS generated:
- forticlient.msi
- forticlient.mst

Packaging

Both files were placed in the same source folder and packaged into a single .intunewin using IntuneWinAppUtil.exe.

The install command in Intune is:

msiexec.exe /i "forticlient.msi" TRANSFORMS="forticlient.mst" /qn /norestart /L*v "%ProgramData%\Microsoft\IntuneManagementExtension\Logs\FortiClientInstall.log"

Issue

The installation completes successfully, but when FortiClient launches, it still displays the "Enter Invitation Code or IP Address" screen.

Even when I manually enter the Invitation Code or the EMS IP address, the client does not register with EMS.

Additionally, the folder:

C:\Windows\FortiEMSInstaller_logs

is not created, so there are no EMS installer logs to review.

Expected Behaviour

I expected the .mst file to inject the EMS configuration so that FortiClient would automatically know the EMS server and register without prompting the user.

Questions

Has anyone successfully deployed the EMS-generated MSI + MST package through Intune with EMS 8.0?
Is there anything else required to ensure the .mst is applied correctly?
Has anyone seen the .mst apparently being ignored after packaging into an .intunewin?
Is there a recommended deployment method for EMS 8.0 that differs from the documentation?

Thank You for your help.

funkylicious

SuperUser

maybe this will help - https://community.fortinet.com/support%2Dforum%2D92/intune%2Dpackage%2Dforticlient%2Dcloud%2Dmsi%2Dwith%2Dmst%2Dthat%2Dcontains%2Dinvite%2Dtelemetry%2Dcodes%2D165183?tid=165183&fid=92

"jack of all trades, master of none"

Forti507

New Member

Hi guys

I recently deployed FortiClient 7.4.8 to production using Intune (as a Win32 app). Registration with EMS occurs automatically and completely silently. I hope this helps you resolve your issue; you can use the same logic to handle the deployment of version 8.0.x in your case!

The root cause of the problem:
When Intune extracts the .intunewin package into the IMECache temporary folder, executing msiexec directly from the Intune console using relative paths (such as `TRANSFORMS="forticlient.mst"`) often fails under the SYSTEM context. Windows Installer loses the reference to the current working directory, silently ignores the MST file, and installs the base MSI without the EMS configuration.

The solution:

Instead of running msiexec directly, create a PowerShell script to manage the deployment. This script dynamically retrieves the absolute path of the extracted files and passes them correctly to the Windows Installer engine, thereby avoiding the issue where the MST file is not recognized.

I have attached the script I developed; I hope you find it helpful. Simply save it as "forticlient-ems-installation.ps1", place it in the same folder as the .msi and .mst files, and package all three items into your .intunewin file.

Once the three files are inside the folder, proceed to package them, selecting the installation script `forticlient-ems-installation.ps1` directly as the main file.

Configure the application in Microsoft Intune and enter the following command in the **Install command** field: %SystemRoot%\sysnative\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden -executionpolicy bypass -file ".\forticlient-ems-installation.ps1"

This command allows PowerShell to run using the x64 architecture, preventing the process from executing under the Intune agent's 32-bit architecture. The ‘Sysnative` path does not correspond to a conventional physical folder. It is a special Windows alias that allows a 32-bit application to access the operating system's native 64-bit binaries.

From the Company Portal, locate the application and run the installation. To verify the process and check the result, review the following log file: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\forticlient-ems-installation.log

If you have an earlier version of FortiClient, the agent will be updated during installation. This process requires restarting the computer. Once you log in to Windows, enrollment with the FortiClient EMS console will occur automatically.