Fortishield.sys BSOD on Windows 10 22H2 and 22H1 machines
Multiple stop codes -
DRIVER_IRQL_NOT_LESS_OR_EQUAL
REGISTRY_FILTER_DRIVER_EXCEPTION
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
All of these show Fortishield.sys as what failed.
We recently updated from Forticlient 7.0.8 to 7.0.9.0493, but this happened on several machines with the previous upgrade from 7.0.7 to 7.0.8.
Seems to be effecting exiting machines (Dell/Lenovo environment, but no Lenovo's have reported issues) as well as newly imaged machines, but there's no common factor. Most of the machines in our environment aren't having an issue, but we've gotten a number of reports. When we image a new machine, it may or may not happen so other than an update, nothing has changed.
I've seen a previous forum post for this where the solution was disabling an antivirus. We use Arctic Wolf for vulnerability scanning and MECM for managing endpoint protection via Windows Defender, but no third-party AV.
Troubleshooting tried so far -
Uninstalling/reinstalling Forticlient - verifying that Fortishield.sys is no longer found in C:\Windows\System32\drivers\ during the process.
DISM /Online /Cleanup-Image /RestoreHealth and SFC /scannow
All OEM drivers are up to date outside of Nvidia drivers (for compatability)
I've manually uninstalled all Forticlient drivers from Device Manager and then reinstalled Forticlient.
All of this has resulted to less frequent BSOD reports, but hasn't resolved the issue. I've also checked the known issues page for 7.0.9, but this issue doesn't seem to be present.
Please let me know if you've got any suggestions.
