Skip to main content
Scott7
Scott7
New Member
February 17, 2026
Question

Windows Security Events for FortiClient's FortiAmsi.dll

  • February 17, 2026
  • 3 replies
  • 649 views

We're running FortiClient 7.4.5. All of our Windows 11 computers contain thousands of events like this in the Windows Security log. There are close to 100 every minute and they're all the same.

 

Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume3\Program Files\Fortinet\FortiClient\FortiAmsi.dll 

I don't know when the issue started, but it has been going on for at least a year and through multiple FortiClient versions. I opened a Fortinet support ticket and they told me it was a Microsoft issue.

 

I'm skeptical that attempting to contact Microsoft would be helpful. Do others notice these events in the security log. The events occur so often that it's hard to find other important events.

3 replies

Stephen_G
Moderator
Stephen_G
Moderator
February 20, 2026

Hello Scott7,

 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

 

If anybody else has any info or advice, please feel free to contribute!

Regards,
Stephen_G - Fortinet Community Team
Scott7
Scott7Author
New Member
February 20, 2026

Thanks Stephen. Yes, if anyone else could chime in, even if it's just to say that you do or don't have this issue with FortiClient, it would help!

AEK
SuperUser
AEK
SuperUser
February 23, 2026

Hi Skott

I have FCT 7.4.5 (on Windows 10) but can't find such file name in my hard disk.

AEK
Scott7
Scott7Author
New Member
February 23, 2026

Thanks for the input, AEK!

vpolovnikov
Staff & Editor
vpolovnikov
Staff & Editor
March 4, 2026

Hello Scott7,

 

This issue has been reported to Fortinet and Microsoft few years ago, and there were efforts on both sides to mitigate it. Tough the error messages couldn't be fully avoided, their number has been reduced in later versions. There is not functionality impact.

Scott7
Scott7Author
New Member
March 4, 2026

Hi VP,

 

Thanks for the feedback. It’s unfortunate that this issue can’t be fully resolved. While I understand there may be no functional impact to FortiClient itself, the fact that the Windows Security log now only retains about half a day’s worth of events does have a functional impact from a security standpoint.

 

I can try to work around this by increasing the log size or exploring other options, but those are still just workarounds.

 

Thanks for chiming in.

Scott

Terms & ConditionsAccessibility statement