New Member

Question

Forticlient Windows upgrade problem - Stop service

7 replies
561 views

I am automatically updating FortiClient for Windows from version 7.4.5 to 7.4.6. On about 50% of the test computers, the installation process stops at: “Stop services.” I also tried doing it manually by running the installer file, but in that case it also gets stuck at “Stop services.” How can I work around this issue?

I have updated versions 7.0.x and 7.2.x many times before and never had this problem. Now I’m updating to version 7.4.x for the first time. Has anyone had a similar issue?

FortiClient

ggolubovic

Staff & Editor

Hi Tomeks,

What you can see in event log for that specific moment when service is stopped ?

Is there any additional info in event logs before that moment ?

awiesel

New Member

Hi. Same problem here. Happened on a handful clients during the update to 7.4.4 and now during the 7.4.7 update many more computers are affected.

M

MarFlow

Visitor III

Hi,

After many unsuccessful attempts to find a solution with Forti Support (over the course of several months), we’ve since come up with our own workaround.

It’s not perfect, but the update has been working without any issues on our laptops ever since.

Depending on the size of the company, this workaround may be more or less practical.

Here’s how it works:

1. Enter the following command in PowerShell: sc.exe config FortiAptFilter start=disabled (There are also other commands/ways how this could work but this is the easiest in our opinion)

2. Then reboot the Windows client. As a result, the service will not have started → The service that is preventing the update from completing successfully is “FortiAptFilter.” You can also see this in the log, if anyone is interested.

3. Start the update now. The update should run without any issues.

4. sc.exe config FortiAptFilter start=system

5. Finally, reboot the Windows client.

I hope that helps!

Best regards,

Marcel

M

MarFlow

Visitor III

Note:
In theory, you can roll out the command centrally on a global scale.
Depending on whether you want to or not.

awiesel

New Member

Good morning Marcel,

thank you for your feedback. Stopping services locally on the clients before the update is not manageable with an acceptable level of manual labor in our environment. Our approach is just disabling the FortiClient completely via EMS when a client is stuck and re-enabling it after the update. This works even if the update has already started if the client has any form of internet access.

But beside that, the situation got better with the last few updates. We didn’t have a failed Windows Update for at least a half year. Are you still experiencing issues right now?

Best
Arne

M

MarFlow

Visitor III

Hi Arne,

First things first: yes, we’re still experiencing this issue with a large number of laptops, regardless of whether they’ve been updated to 7.4.4, 7.4.5, etc.
It also occurs when updating from 7.4.7 to 7.4.8.
The ticket we opened months ago regarding this issue is still open with Forti Support.

From my perspective, any workaround is “bad”. This is a feature Forti offers precisely for situations like this - so you don’t have to access each FortiClient either in EMS or locally on the user’s device. No matter how large the company is. Even with just 20 people, I think it’s already a hassle to either a) go to each person and execute the commands or b) log into the EMS and deactivate the FortiClient there.

If the update goes through the update mechanism (→ deactivate in EMS-Solution), we’ll run into the problem that people will end up stuck in our inhouse-support again. If they end up in support, that means more effort for us and more work that would have to be put into it.
From my perspective, one approach is more proactive and the other is reactive. Both have pros and cons. Everyone does it however works best for them 😄

As long as the feature provided by Forti doesn’t work, there will always be a certain amount of administrative effort involved.

What disappoints us so much is that, despite the great effort we’ve put into providing numerous logs, test scenarios, etc., Forti Support has shown us very little understanding in this matter. And it feels like they're just trying to string us along until we give up or find our own workaround.

We’ve provided a lot of feedback, and the last response really disappointed us - it simply said, “Try version 7.4.8; it includes code changes.” Note that they were speaking rather generally about the code base, not about our specific problem.

To sum it up, we (at our company) are just frustrated and really annoyed. I think, unfortunately, you can tell that a bit from the way my messages are written.

Have a nice day

Kind regards,
Marcel

bfernandez

Staff

please try the following:

disable "sandbox" profile and "cloud-based malware protection" feature from "malware protection" profile
wait for forticlient to sync the settings
restart the endpoint
start the upgrade

we used this workaround for another customer already

the root cause of the problem is not yet 100% clear

Sign up

Login with SSO

Login to the community

Login with SSO