Explorer

Solved

FortiEDR - Error Code OS settings outdated

14 replies
4437 views

Hello,
I am facing an error code to a random number of windows hosts (approximately 30/400 windows 11 home & windows 11 pro devices).
The mentioned devices has recently appeared in the state " Running (OS settings outdated" and the error code is "OS settings outdated". I have tried to reload & uninstall and re install the collector with no luck. The collector version is 5.2.6.0065.
Any ideas will be helpful in order to further troubleshoot the issue.

BR

FortiEDR

BKP09Answer

Explorer

Hello,
TAC said is was a bug, we waited for the updat of the client and the issue resolved.

FortinetFort

Visitor III

I am having the same issue Windows 11 Pro 24H2

mvatansever

Explorer III

Hello,
Have you tried updating the Collector to version 5.2.7.0072? This version appears to resolve some OS compatibility issues.

BKP09Author

Explorer

I Upgraded since this was and the TAC's approach but no luck so far. In addition to the OS settings outdated there is also a growing number of disconnected hosts.

BKP09Author

Explorer

Upgrade did not help so far. Latest windows updates are installed to the mentioned devices. In addition to the OS settings outdated there is also a growing number of disconnected hosts. I have opened a TAC ticket and i am waiting for their feedback.

AhmedSwailem

Explorer

I started to face the same issue, Also opened a ticket.

OS edition: Microsoft Windows 11 Pro x64

OS version: 24H2

OS build: 26100.3775

Please update us here if you have any new updates.

Thanks

S0ck-Pupp3t

Explorer III

I started to see this a little bit. Watching for answers on this.

Secusaurus

Contributor III

Hi @BKP09 / @S0ck-Pupp3t / @mvatansever / @AhmedSwailem

Was it resolved in your versions with TAC? Did it reappear?

We see this with a enormous amount of clients still in current versions (don’t agree to “fixed this permanently in 5.2.8”) with the “disconnected” issue BKP09 mentions. See bug ID 1261403 in the current version as well: Collector 6.1.1.1281 stops unexpectedly
We are MSSP, so we have different customers with different deployments (with and without AD, servers, clients, small and large devices, different vendors, etc), the issue is spread around all of them.

We are on it with TAC and they call the 6.2.x a “permanent fix” as well, but I would like to get the big picture here.

So any input would be appreciated (if preferred, DM is ok as well).

Thanks all!

Christian

NSE8 | Fortinet Advanced MSSP Partner

BKP09Author

Explorer

Hello @Secusaurus , exactly same state here again. TAC also called the 6.2.x a permanent fix but the only way to resolve the issue is to uninstall all affected devices each and every one independently and install the new version. But as you already mention we have a variety of customers and manually uninstalling 100s of collectors is not optimal. We have a client with almost 200 collectors having the bellow error message and TAC’s response is uninstall it manually.

If you find any solution to overcome this manually step i will be so pleased if you can share it. I am trying to figure it out as well but nothing promising so far.

Secusaurus

Contributor III

Hi @BKP09,

We got a powershell script from TAC (which was probably shared with you as well?), but this only makes sense for servers etc.

For the clients which you cannot reach through a GPO “at 10 AM uninstall, then reboot” and the “at 12 AM install the fixed version”, because they are anywhere or on vacation or else, we only saw the manual process.

And: We did this already from 5.x to 6.1.1 with the proposal “that's the permanent fix”. I don't think, our customers will do that another time..

If you don't have the powershell script, ask TAC (or DM your mail address and I can share it with you).

Best,

Christian

NSE8 | Fortinet Advanced MSSP Partner

Sign up

Login with SSO

Login to the community

Login with SSO