how to remove AV and Anti ransomware only

Hi @espinad ,

FortiClient’s Antivirus + Anti-Ransomware are packaged together as the Malware Protection module. Once that module is installed it cannot be “un-ticked” from Programs & Features; the only supported ways to drop it are:

1-Re-install with a package that omits Malware Protection. Either use the VPN-only installer create and redeploy an EMS installer with Malware Protection turned off.

https://docs.fortinet.com/document/forticlient/7.4.3/ems-administration-guide/942839/adding-a-forticlient-installer

2-Keep the module but disable its scanning functions (EMS-managed endpoints). In the endpoint profile open the Malware Protection tab and toggle Antivirus, Anti-Ransomware, and Real-time Scan to OFF. Drivers remain loaded but no files are scanned, so you can run a third-party AV side-by-side.

https://docs.fortinet.com/document/forticlient/7.4.3/ems-administration-guide/447132/malware-protection

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

Hello @espinad ,

You can push the new installer from the EMS with the required feature, when you push the fct from EMS, the flow would be:

FCT will download the installer locally that you are pushing from EMS, take backup, uninstall the existing forticlient, ask for reboot, install the earlier download installer and then upload the backup.

Thanks,

RS