Endpoint management server (ems) is actively blocking this forticlient from registering

[dan_newcombe]

This has happened twice now.  We have remote clients who receive

   "endpoint management server (ems) is actively blocking this forticlient from registering"

from the Forticlient (6.2.6) when they try to register to our EMS server.  Other clients with the same release, also remote, have no issues.  

The one last week, I believe that the fix was to reinstall the Forticlient because in that case, they had an older version.  But the person today has the same version as everyone else.   Reinstalling (and even RemoveFTCID) did nothing but extend the trial period of the VPN.   

What is really annoying is I can find NOTHING on the EMS server to help figure out what is going on.   The logs are happy to tell me about how well it's syncing up our AD users via LDAP.  But there is nothing at I can find for this client in question.

So any idea where to even start on this?   Thanks

[dan_newcombe]

Looks like random reddit post was actually truthful.  In the 6.2.6/6.2.7 release notes is

606466 "FortiClient registration was blocked by Endpoint Management Server (EMS)" message occurs when FortiGate is in Telemetry list.

No idea what that means, why it's only affecting a couple clients, or where to find more info on this.

[papexa]

users are reportedly facing issues citing unable to send their text messages as message blocking is active. Here we provide you info about troubleshooting message blocking is active issue on both iOS and Android devices. Here is the solution for the errors like ‘unable to send message message blocking is active and others.

[dan_newcombe]

Never found anything to resolve this.   But we did work-around.   Working with support, one step was to delete the machines from EMS and re-add them, however the machines were not showing there.   The machines are stand alone machines - not on the domain.  One of the more problematic ones was joined to the domain and has not had issues since.

It appears that EMS does not play well (or understand) a mix of domain based computers and workgroup based ones.  

FYI - these workgroup ones were at home for remote access and at the time we felt that was the easier path for end users - a local account that auto-logged in, and didn't expect for this C-19 issue to go on for this long!

Just putting this out there in case anyone else ends up in the same situation...a semi-answer.

[kewimpu]

Here is some info about troubleshooting message blocking is active issue on both iOS and Android devices.

[Jimbo1147]

I am having the same issue with 6.4.6.

Most of my clients register without issue (429 out of the 460 or so we have deployed to)

I currently have about 30 that will not register no matter what I do.

I have verified that they are in an AD container which is managed.

Verified Network

Uninstalled/Re-installed

Worked with support and am no closer to an answer.

[network360_2021]

we can check the  logs whats happening for that we have to simulate same issue again .

1. remove issue reported client from  EMS 

2. Set log level on the EMS to debug

3. collect Fcmdaemon log to verify registration data logged by the EMS

for changing EMS log level to debug - (version 6.2 EMS ) System settings-->logs--->log level .

to get fcmdaemon log goto EMS server -->installed folder (program x86)--->Fortinet--->ForticlientEMS--->run FcmDaemon.exe --->to get log same folder fcmdaemon[date,time].log  (download logs to computer )

please collect both logs and verify , log collection should run while simulating issue again then only we will get proper logs

Thanks,

Network360

https://www.youtube.com/channel/UCSQUIhnEgz2-6JP_ykhIMUw

[HULKFish]

What worked for me is unchecking Enable Management on the EMS.  I then Disconnected the Telemetry GW and set the Telemetry GW on the FC and the FC then connected.

[BaQeR]

Verify if the name of PC is "excluded on mangement" on the liste of endpoints