FortiClient EMS auto-registration and multiple-user computers

---

@SubjectNamemyolsd.usfirekirin wrote:

I need to configure our environment for both single and multi-user, domain and workgroup (personal) computers.. Ideally we want absolutely no user interaction required for the shared domain pc's, at any point. These are EntraID or hybrid-joined, managed by Intune. They don't need different configuration profiles based on the user login, although we would still want to track who is logged in of course.

 

However, auto-registration appears to only occur once during initial installation. When another user logs in, FortiClient reverts to being unregistered for that user, requiring them to enter an invite code. I would have thought it would attempt auto registration again and perform SAML user verification automatically, but it does not.

We need to keep the shared devices as free from user interaction as possible, while still securing against rogue installs. Is there a different way to go about this?

---

For FortiClient EMS auto-registration on shared computers, the issue arises because auto-registration typically occurs only once during initial installation, and additional users must manually register. To address this, consider configuring FortiClient to run in a system-wide mode where it is registered once and remains active across user sessions

Hello, 

I would suggest revising intune configuration options. 

https://docs.fortinet.com/document/forticlient/7.2.0/intune-deployment-guide/776135/configuring-the-forticlient-application-in-intune

https://docs.fortinet.com/document/forticlient/7.2.4/ems-administration-guide/470857

https://docs.fortinet.com/document/forticlient/7.2.4/ems-administration-guide/334169

Or alternatively, you can connect your already installed endpoints via FortiEsnac

https://docs.fortinet.com/document/forticlient/7.2.4/administration-guide/095591/forticlient-windows-cli-commands

c:\Program Files\Fortinet\FortiClient\FortiESNAC.exe -r|--register <address/invitation> [-p|--port <port>] [-v|--vdom <site>] 

If the verification type is selected as Domain or SAML there will be user interaction one time.

Then, Forticlient will open in connected status unless it has not been disconnected. 

 Please let me know if that helps. 

I tried this command its working fine with local user

c:\Program Files\Fortinet\FortiClient\FortiESNAC.exe -r register <address/invitation>