Help
FortiEndpoint
FortiEndpoint is a cloud based EMS solution hosted by Fortinet, built for new deployments. It combines FortiClient Cloud and FortiEDR, offering everything available in FortiClient Cloud with the added ability to deploy and manage FortiEDR collectors.
FortiClient Cloud handles the deployment and version management of collectors. When a deployment is created, a matching EDR collector group is automatically created. Endpoints added to the deployment are also added to this group.
In a standard EDR setup, version control is managed directly in the EDR console. With FortiEndpoint, this is done through the FortiClient installer settings. Collector group configuration stays within FortiClient Cloud, while policy and playbook management continues to be handled through the EDR console.
rduggal_FTNT
Staff
Staff

Created on ‎04-22-2025 07:30 AM Edited on ‎10-28-2025 04:09 PM By Moderator

Article Id 388692

Technical Tip: How to Uninstall FortiEndPoint components from Endpoint to free up licenses

Description This article describes how to Uninstall FortiEndpoint Component, i.e, FortiClient and FortiEDR, from the Endpoint to free up licenses.
Scope Applies to Cloud FortiEndPoint deployments.
Solution
  1. Create a Workgroup on FortiClient EMS, which will be used in a Deployment to carry out the uninstallation task. In this example, it has been created a Workgroup named 'Uninstall'.

Steps: Login to Cloud FortiClientEMS -> Endpoints -> Workgroups -> 'Right Click' 'All Groups' -> Create group named 'Uninstall'.


image1.png

 

  1. Configure a new Deployment to perform Uninstallation.

Steps: Login to Cloud FortiClientEMS -> Deployment & Installers -> Manage Deployment -> Add -> Name it accordingly -> Edit Endpoint and Groups.

Assign Workgroup 'Uninstall' configured in the above step to it: Select Action Uninstall -> Depending upon business requirement, it is possible to perform an attended or unattended installation. In this example, perform the Attended installation where user is going to get a prompt to Uninstall the FortiClient which also includes FortiEDR.

 

image2.png

   

  1. Move the endpoint to the Workgroup 'Uninstall' from which the FortiEndpoint agent needs to be removed.

Steps: Login to Cloud FortiClientEMS -> All Endpoints -> Select the required Endpoint/Endpoints -> Move to Group 'Uninstall'.

 

image3.png

   

  1. The Endpoint will receive a prompt as shown below. As soon as the user selects Remove Now, FortiEndPoint components (FortiClient and FortiEDR) get uninstalled and the endpoint will be rebooted.

 image4.png

 

Note: Excluding an Endpoint from FortiClient EMS would free up FortiClient license. However, the EDR license is still going to be consumed. In such scenarios, to free up the EDR license, the FortiEDR Collector agent needs to be manually uninstalled.

 

Windows.

  1. Stop the service using the command 'C:\Program Files\Fortinet\FortiEDR\FortiEDRCollectorService.exe' --stop -rp:INPUTPASSWORD.
  2. Uninstall FortiEDR Collector Agent.

Technical Tip: How to uninstall FortiEDR Windows Collector with msiexec using product ID GUID 

 

MacOS & Linux:

Uninstalling FortiEDR Collectors - FortiEDR 6.2.0 administration guide

 

If there are still any problems encountered, open a new technical support ticket for further assistance: Support Fortinet. 

Attached FortiClient logs (Diagnostic Tool output .cab ). The diagnostic tool can be executed from the FortiClient About page.

Path-Win: User\AppData\Local\FortiClient\tmp\Diagnostic_Result

Path-MacOS: cd /Library/Application\ Support/Fortinet/FortiClient/Logs
608
0 Kudos
Suggest New Article
Article Feedback
Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Social Media
Security Research
Company
News & Articles
Contact Us

Copyright 2025 Fortinet, Inc. All Rights Reserved.