FortiClient Endpoint Unprotected status

[migacz]

Hi 

i just upgrade EMS server to 1.2.4 and now i have Unprotected status on all my endpoints, any idea why?

Clients are connected to EMS server, up-to-date, telemetry is OK

M

[wizenhimur]

I just upgraded to 1.2.4 and having same issue any fix?

[Carl_Wallmark · Accepted solution]

Is that not old computers in your AD ? Computers that is not deleted or does not have forticlient installed? The EMS scans all of the directory.

[migacz]

no fix, i thing it is some bug

[migacz]

i dont have old computers accounts, only active

[mphillips]

Has there been any real resolution to this? I am having the same issue. It says I have "144 unprotected." I am 100% sure these aren't all old computers, since this is basically a total of all computers in my organization- and almost all do have Forticlient installed. They also have real time antivirus protection enabled, application & web firewall enabled, and are sending telemetry to Fortigates.

[mphillips]

Ok- by toggling around with filters I think I have it figured out. Seems to be that "unprotected clients" are clients that are not participating in compliancy. So if you are not using compliancy through Forti's security Fabric, all active computers will show up as "unprotected."

Here's how I determined it with the filters. My organization has a combination of active and inactive computers (222 endpoints to be exact). My "unprotected clients" total is 144. When I selected the "not participating in compliancy" filter, I got a total of 143 endpoints, which I figured is close enough.