That link really didn't tell me anything, I understand how AppLocker works (I configured it). The issue here is that my organisation whats CMD.exe to remain blocked but anything added to the FortiClient post script connection such as the below spawns a CMD to run the commands even if that command is run a powershell:
<on_connect> <script> <os>windows</os> <script><![CDATA[eventcreate /d "This is my sample event" /t information /id 10 powershell.exe -ExecutionPolicy Bypass -File "C:\Temp\Temp\Temp.ps1"]]></script> </script> </on_connect>
Because FortiClient spawns CMD.exe from its default directory there is no way for me to bypass the applocker rule I would have to turn it off completely.
I was looking to see if anyone else had come across this before and found a way to either use the login script where CMD.exe was not required or clevely bypass it. I can't imagine we are the only organisation that blocks CMD.exe.
So I enabled cmd.exe on my machine in AppLocker just in case I can convince the business to allow it but the issue is even with that enabled the FortiClient is spawning .CMD files in the Temp user folder under random names to run the scripts.
There is no way I can get sign off to allow randomnly named .CMD files to run from a users temp folder, thats just too big a security hole.
I really think the dev team should spend some time getting a better post script system set up that does not require such a security hole.
I was struggling with the same issue, we have AppLocker blocking this as well. There is a solution, you can allow a file hash rule in your AppLocker's Script Rules. Grab the CMD file that FortiClient will run on connect, import the file hash of that CMD and Allow that hash to run.
Downside of this is that with every change of the On Connect (or On Disconnect) script you'll have to update the AppLocker policy to the new file hash.
I have tested it (EMS 7.0.8 & FortiClient 7.0.8), and it works, even the same script content copied to other Remote Access policies / VPN tunnels works.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.