Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Deploy forticlient VPN with config (No EMS)



Our company is using an old version of FortiClient ( We want to migrate approximately 200 laptops to the latest version (


Actually, the VPN config is set by Windows registry entries. Is it possible to keep the VPN configuration from the windows registry ?

Otherwise, is it possible to deploy the latest version with a conf file ?


For your information, we don't have a Forticlient EMS.


Thanks for your support !

Community Manager
Community Manager




I have found a document that can help you:


Could you please tell me if it helped?


Anthony-Fortinet Community Team.

Good day,


I can't seem to access this document


Hey fmco,


given that you're using a fairly old FortiClient version, I'm not sure if the registry settings can be retained, and deploying a FortiClient installation from scratch with a configuration file requires a modified installation file, which in turn relies on EMS.

However, you can technically just do a regular FortiClient installation, and prepare a config backup (.xml file), and then restore that config file to the installed FortiClient(s).

I'm really not sure if this can be done in bulk though, or if a prepared FortiClient configuration backup would need to be restored individually on each client; any guides we have for bulk deployment/configuration/upgrade of FortiClient usually relies on EMS.

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++


This should be doable this way:

  1. Install FortiClient VPN 7 on a Windows machine
  2. Configure FCT VPN 7 as required
  3. Run regedit and find the registry key for FortiClient (should be somewhere in HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient)
  4. Export the reg key
  5. Use GPO to deploy your new FCT 7 + reg key file on your 200 hosts


New Contributor

Unfortunately, this key from the HKLM registry... will not contain the correct Pre-shared key because it is encrypted and has a different form on each computer.
Any other ideas besides EMS?


This is actually good news. It would have been very insecure if we can duplicate the VPN password via such simple copy operation.

You'll need to find another way to set the password. Otherwise if you use IPsec VPN then you may try with certificate authentication method, I think it can be more suitable for such massive deployments.

New Contributor

We've done this for a about thousand endpoints on v7 with a 3rd party deployment tool and powershell (uninstall  / re-install / import config as all that can be done from the CLI.

Helps that its sslvpn and doesn't need to store anything except the destination, but maybe you can follow a similar principle?


Mr Grumpy, could you please elaborate on how you got the config pushed with your third party deploy tool? We use PDQ, I can do the install just fine, but then have to configure each end point by hand. Sure would help if I can push the config with PDQ as well. 


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors