Forticlient slowing down Windows 11 update 24h2
Hello there,
We are having issues on machines trying to update to the last windows 11 update 24h2.
The updates are taking way too long, some of them taking 5 hours to complete. Our machines all have SSDs installed, so, don't think it is an I/O issue.
We tested machines without forticlient and they finished updating in about 10 minutes.
Our forticlient versions are 7.2.4.0972 and 7.2.5.1053 (tested in both of them and the issue persists).
I tried disabling Cloud based protection and refining antivirus exclusions, to no avail. Exclusions are as follows:
Paths:
%windir%\SoftwareDistribution\Datastore
%systemroot%\System32\Spool
Files:
%windir%\Security\Database\*.log
%windir%\Security\Database\*.sdb
%windir%\SoftwareDistribution\Datastore\Logs\Edb.chk
%windir%\SoftwareDistribution\Datastore\Logs\Tmp.edb
%windir%\Security\Database\*.chk
%windir%\Security\Database\*.jrs
%windir%\Security\Database\*.csv
%windir%\Security\Database\*.edb
%windir%\Security\Database\*.xml
%windir%\SoftwareDistribution\Datastore\Logs\Edb*.jrs
%windir%\Security\Database\*.cmtx
C:\pagefile.sys
C:\swapfile.sys
C:\hiberfil.sys
%allusersprofile%\NTUser.pol
%Systemroot%\system32\GroupPolicy\registry.pol
I collected some logs from a machine that took almost 4 hours to complete the update (from october 3rd, 10:40 to 14:05). I couldn't find any explanation for what I found. Some entries I repeatedly see on these logs are:
03/10/2024 11:17:29 debug update update process sending request: 07002000FVDB01300000920772499999 ##this numer seems random.
03/10/2024 11:59:58 debug av <appdbClient.msg 6> [file: , pid: 0]
03/10/2024 12:00:34 debug firewall scheduler called us