| Description | This article describes how to install FortiClient EMS (version 7.2 for Microsoft Windows) on a VM using a database located on a separate VM (VMs not joined to the Windows domain), and how to configure shared folder permissions to allow FortiClient EMS to perform backups. |
| Scope |
(FortiClient EMS) + C:\SharedDir\Backup (SQL Server Express) [ WS2019EMS VM ] [ WS2019EXPDB ] + + | 10.5.62.117 | 10.5.62.118 +-------+-------------------------------------+----+ (10.5.48.0/20)
Note, this installation uses:
The same concepts can be respectively extended to different SQL editions, Windows versions, and the default Windows admin 'Administrator'. |
| Solution |
On the database VM:
Install the SQL Server (this use case uses SQL Server listening on the standard port TCP/4444).
Go to Secure Server Configuration Manager, enable the Network Connection and set all IPs (tab IP Addresses) with the desired custom TCP port (4444 in this sample).
Configure the SQL service to run under the local Administrator account 'EMSAdmin' (Windows Server administrator).
After, the service must be restarted:
Run SQL Server Management Studio, use the default Windows Authentication, Trust the certificate (under Advanced Options), and select Connect.
Go to the top entry (db name), right-click, and select SQL Server and Windows Authentication mode.
Go to Security -> Login and right-click New Login. On the new window, General, add a login name (fcems), select SQL Server authentication and specify a password (Fortinet!). Deselect Enforce password policy.
Navigate to the Server Role page and select the following:
Restart the service by selecting the db name, right-clicking it, and selecting Restart.
Typically, the SQL Server instance service runs under the local system account. Configure the service so that it runs under a local admin account.
On the EMS VM:
Create a backup directory on the EMS server:
See the administration guide for instructions to create the following shared backup directory:
Provide permission to the shared directory:
Tab Sharing:
Ensure the 'Everyone' group was not present. Otherwise, remove it.
Note:
Tab Security:
Set the Local Security Policy on the EMS VM (WIN+R , then secpol.msc).
Allow the same permissions to the Administrator (user) and Administrators (group).
EMS CLI Installation:
To install EMS so that it uses a remote SQL Server instance, use the CLI to specify the correct SQL Server / instance. The following is an example of the command to use for the installation (installation under local administrator account EMSAdmin). It assumes that the installation file FortiClientEndpointManagementServer_7.2.8.1152_x64.exe is located in C:\Users\EMSAdmin\Desktop.
C:\Users\EMSAdmin\Desktop>.\FortiClientEndpointManagementServer_7.2.8.1152_x64.exe SQLServer=WS2019EXPDB SQLUser=fcems SQLUserPassword=Fortinet! SQLPort=4444 SQLService=SQLEXPRESS InstallSQL=0 ScriptDB=1 BackupDir=\\WS2019EMS\SharedDir\Backup
The command installs EMS pointing to a remote named instance with the following attributes:
Certificates.
Consider using a specific webserver certificate. To prevent warning message connecting the EMS, the CA certificates have to be imported on the VM that runs EMS (local administration) or the remote host that needs to access the EMS server.
To check the proper EMS installation and folder permissions setup, perform a EMS backup (The backup must complete without errors, and the shared folder must contain the backup file).
Related documents: |
