Skip to main content
MarkusKoehler
New Member
July 18, 2024
Question

Windows updates fails with enabled Forticlient

  • July 18, 2024
  • 24 replies
  • 14945 views

Since last week we experiencing a lot of problems with Windows updates (mostly Windows 11, but there was one Windows 10 among them as well), specifically KB5040442. On about 10% of our Windows clients the update would start and go until 96% and stay there for 10-60 minutes, and then after a restart Windows would tell us that something did go wrong and it would reverse the update. This would require multiple restarts and anything in the order of 2-10h. The usual information sources did not reveal anything unusual with this update round, so it had to be some uncommon conditions here.

 

When Windows was back online, it would sometimes (!) show an error code 0x800f0922, oftenly nothing, and on next restart it would try to install it again (and our employees losing again 4-10h with a working computer). First remedy, as described in the error code was to increase the size of the recovery partition to at least 250MB, but that helped only on one computer. No other things related to the code did apply to us or help. DISM and SFC sometimes would find something, but did not help in fixing the issues with the update. Over time some of the computers randomly succeeded in installing the update.

 

Last straw I had was to disable and uninstall Forticlient. And with that so far all of the clients went through the update without a hitch. Now I am anxious that it will return with the next update when I reinstall Forticlient. In retrospective, two computers had some troubles with some previous updates, but we re-installed Windows on them. Both were also affected this time.

 

What should be do and how can we prevent that from happening again? Is there anything to further debug and diagnose this issue?

 

For your reference we use Forticlient 7.2.4.0972 with EMS, and a Fortigate 200F as main firewalls. We have the web filter, AV and real-time protection enabled, as well as Anti-malware, Anti-Exploit and Cloud-base malware protection.

 

Thank you in advance for your help.

 

Regards,

Markus

24 replies

IHaveAProblem
New Member
November 29, 2024

We are also facing this issue and I know of one other company with the same symptoms. Our last Fortinet case was dragging on for too long and it was hard to reproduce on demand so it was closed. I hope you have better luck and would love to know the root cause. I personally don't have a good experience with Forticlient.

awiesel
New Member
December 2, 2024

Good morning IHaveAProblem and VinceMoon,

 

the Forti support just responded us and they have no idea what might cause the issues. No obvious hints in the debug logs. We shall try FCT 7.2.6 and asked if some Sophos products are installed. If 7.2.6 won't help, they want to involve the dev team.

 

Beside that, we figured that it seemed to help when you disable all network traffic related components. In our case, this was web filter, video filter, sandbox and firewall. Maybe you could try this on the upcoming patchday.

 

Regards

Arne

psevca
Staff
Staff
December 6, 2024

Hello,

the issue was reported to the engineering team today using the details from the original reporter "Markus Koehler" and the TAC ticket that was created for the same issue within TAC EMEA Team.

 

regards

 

Peter

awiesel
New Member
January 13, 2025

Good morning everyone and a happy new year!

 

With 7.2.7 the issue seems to be resolved or got at least a lot better. We only had one client which made problems and took about one hour for the December updates. Other previously problematic clients ran the updates within a few minutes, this is fine.

 

What are your experiences with 7.2.7?

 

Regards

Arne

VinceMoon
New Member
January 13, 2025

Hi Arne,

Good to hear from you. December's updates haven't been a problem for us. We are still on 7.2.4 but turned a lot of security features off prior to the update. I also note that the December's patches are always quite "light". Also there was no .net updates in December. Fingers crossed for this month's patches!

awiesel
New Member
February 14, 2025

Good morning all. Seems like the issue is back. Windows Update KB5050009 and 24H2 are causing massive problems at our site which mostly go away when we turn off FortiClient completely. Anyone else experiencing that?

Thom_Castor
New Member
April 7, 2025

Same issue here in my company, starting from FCT version 7.0.10 (ish) and still issues in 7.2.5, 7.2.8 and 7.4.0.

Got a case running with TAC but no resolution yet. Also pretty difficult collecting logs afterwards.

My workaround now like some others is switching from a general used profile to a workaround profile where AV/SB is disabled. (I figured the EMS connection remains online when Windows tries to install/reboot). After the reboot I switch them back the the general profile.

 

 

New Member
July 13, 2026

Can I shut down SB and AV while the device is 98% From  ems? 

 

 

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.