Skip to main content
MG4
MG4
Explorer III
August 10, 2026
Solved

FortiEndpoint EMS Cloud – FortiEDR installation fails on Windows 11

  • August 10, 2026
  • 4 replies
  • 141 views

Hi,

I would like to know if anyone else is experiencing similar issues with FortiEndpoint EMS Cloud and the integrated FortiEDR feature.

Our environment is currently running:

  • FortiClient EMS Cloud: 7.4.7 build 2194 (Mature)
  • FortiClient: 7.4.7
  • Windows 11 25H2: Build 26200.8875
  • FortiEDR Engine assigned by EMS: 5.2.8.0044

Originally, we noticed that some endpoints using the same EMS policies and profiles had FortiEDR working and connected, while others showed FortiEDR Disabled in FortiClient and Disconnected in FortiEDR Cloud.

Both working and affected endpoints are operating in the same environment and network, which makes the different behavior seem questionable. We are also seeing the same issue on endpoints in customer environments, so it does not appear to be limited to a single device or network.

We also tested multiple FortiClient versions, including 7.4.4, 7.4.5, and 7.4.6, but the behavior remained the same.

On affected endpoints, the Collector reported:

FortiEDR Detected incompatible manager. Missing registration information

After working with Fortinet TAC, we used the FortiEDR Cleanup Tool to completely remove the old Collector installation.

Since then, FortiEDR can no longer be installed on the affected endpoint through either:

  • EMS Cloud Deployment
  • a newly generated FortiEndpoint installer

EMS reports:

Deployment state 150 - Deployment Error
NsloInstallFailed

Windows Event Viewer shows that MsiExec.exe crashes while installing the FortiEDR component:

Event name: BEX64
Application: MsiExec.exe
Faulting module: MSIxxxx.tmp_unloaded
Module version: 7.4.7.2003
Exception code: c0000005

The subsequent MsiInstaller event reports:

Product: Fortinet Endpoint Detection and Response Platform
Product version: 5.2.8.44
Installation status: 1603

TAC confirmed that FortiEndpoint version 26.3 currently supports only FortiEDR Collector 5.2.8.0044 for Windows and is checking internally why the installer crashes.

Has anyone else seen:

  • FortiEDR becoming Disabled/Disconnected on otherwise identical endpoints?
  • NsloInstallFailed / Deployment Error 150 when installing the EDR feature?
  • MsiExec.exe crashing with 0xc0000005 while installing EDR 5.2.8.0044?

Kind Regards,

MG4

    Best answer by MG4

    We had another troubleshooting session with Fortinet Support, and what appears to have finally resolved the issue was the following:

    1. The latest FortiEndpoint version was installed, which appears to have restored or reinstalled some FortiEDR Collector components on the affected endpoint.
    2. After that, we ran the FortiEDR Cleanup Tool again. This time, it was able to properly clean up the remaining FortiEDR components.
    3. We were then finally able to install the FortiEDR Collector successfully again.

    So in our case, the combination of installing the latest FortiEndpoint version first and then running the FortiEDR Cleanup Tool again seems to have resolved the broken installation state.

    Unfortunately, it took far too long to identify and resolve this issue, but the affected endpoint is now working again.

    4 replies

    Stephen_G
    Staff & Editor
    Stephen_G
    Staff & Editor
    August 13, 2026

    Hi MG4,

    Thank you for using our forums. We will seek to get you an answer or help.

    In the meantime, if anyone else has any advice, please feel free to contribute.

     

    Stephen_G - Fortinet Community Team
      MG4
      MG4Author
      Explorer III
      August 14, 2026

      Update:

      I performed some additional testing and found a possible connection to another issue we are currently investigating with Fortinet.

      In both our FortiEndpoint EMS Cloud environment and one of our customer's EMS Cloud environments, an unexpected license activation occurred without any manual registration or action from our side.

      Before this happened, both EMS environments used default as their domain. After the unexpected license activation, a new domain with a randomly generated name appeared in both environments.

      Since then, I have tested the FortiEndpoint installer on multiple endpoints and also generated new installers from both our EMS Cloud and the customer's EMS Cloud. In all cases, the FortiEDR component installation failed in the same way.

      This makes me suspect that the issue may not be endpoint-specific, but could be related to the FortiEndpoint EMS Cloud backend, the unexpected license/domain change, or the way the current Endpoint installers are being generated.

      At this point, this is only a hypothesis and has not yet been confirmed by Fortinet TAC.

      If anyone else using FortiEndpoint EMS Cloud has recently noticed:

      • an unexpected license activation (visible under Administration → Log Viewer, in our case at 2026/07/26 02:35:40)
      • a new randomly generated domain appearing in FortiAnalyzer for the FortiEndpoint EMS instance
      • FortiEDR installation failures after such a change

      I would be very interested to know whether you are seeing the same behavior.

      Kind Regards,

      MG4

        MG4
        MG4AuthorAnswer
        Explorer III
        September 2, 2026

        We had another troubleshooting session with Fortinet Support, and what appears to have finally resolved the issue was the following:

        1. The latest FortiEndpoint version was installed, which appears to have restored or reinstalled some FortiEDR Collector components on the affected endpoint.
        2. After that, we ran the FortiEDR Cleanup Tool again. This time, it was able to properly clean up the remaining FortiEDR components.
        3. We were then finally able to install the FortiEDR Collector successfully again.

        So in our case, the combination of installing the latest FortiEndpoint version first and then running the FortiEDR Cleanup Tool again seems to have resolved the broken installation state.

        Unfortunately, it took far too long to identify and resolve this issue, but the affected endpoint is now working again.

          Jean-Philippe_P
          Staff & Editor
          Jean-Philippe_P
          Staff & Editor
          September 2, 2026

          Hey MG!

          Glad that your issue is fixed and thanks a lot for sharing the solution to everybody :)

          Regards,

          Jean-Philippe - Fortinet Community Team
          Terms & ConditionsAccessibility statement
          Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!