Troubleshooting Tip: Identify FortiClient deployment issue

[btan]

Description	This article describes how to troubleshoot the FortiClient deployment issue. It is possible to check a few items in EMS, and the installer logs in to one of the affected endpoints. Below are the steps to do initial checking before engaging Fortinet TAC. On a side note, it is advisable to test deployment on a small group of endpoints (for example, five) before mass-deploying to all endpoints.
Scope	EMS, FortiClient v6.4, v7.0, and v7.2.
Solution	Make sure that the endpoint can reach the EMS IP/FQDN on ports 8013 and 10443. In EMS, ensure that the Deployment Package is configured: Once deployed, it is possible to monitor the status by hovering over the progress bar below. Select it to see details: It is also possible to check in the endpoint pane. In the affected machine, navigate to C:\Windows\FortiEMSInstaller. It should download the FortiClient installer here: In the affected machine, navigate to C:\Windows\FortiEMSInstaller_logs, the fctinstalllog.txt log will explain what is happening in backend processes, what is failing, etc. Notes: After the endpoint reboot (part of the FortiClient upgrade process), this log file size will gradually increase, meaning the backend process is running correctly and it is installing the new FortiClient version. Steps 4 and 5 are also applicable when troubleshooting the FortiClient upgrade issue on the FortiSASE platform. Working with Fortinet TAC: If it is still not possible to identify what is failing, navigate to C:\Windows\, zip the whole FortiEMSInstaller_logs folder, and attach it to the TAC ticket for TAC assistance.