FortiClient on Windows Servers

[pieciaq]

Hello there,

I need to replace old AV software installed on Windows Servers in our organization.

Because we already have about 400 Forticlients installed on users computers connected to EMS I want also make it for servers.

I was thinking about making additional profile, with disabled Remote access, Web filter and Firewall and adding some exclusions for files, folders or extensions (ex. .ldf, .mdf on SQL server).

I want to install it on AD, DNS, DHCP, File servers, some App servers and SQL servers.

Do you have some additional suggestion I should be aware of?

[btan · Accepted solution]

Hello,

As you may already know, App Firewall feature is not supported in Windows Server OS. It is important to NOT to install App FW module (disabling in profile is not sufficient) when you install FortiClient (FCT) (either packaged by EMS or when you install it manually, do not select App FW module). Otherwise, you may face performance issues, refer: https://docs.fortinet.com/document/forticlient/7.0.7/windows-release-notes/549781/product-integratio...

Here is the list of other AV scanning exclusion path recommended by Microsoft.
It is intended for Windows Defender, you may gauge your own needs and applicable to FCT too:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-server-exclusio...

[pieciaq]

Thanks a lot! It will definitely help.

One more question - when need to make some application excluded from scanning and if in: Path to Excluded Files window will put something like *\applicantion_name.exe without exact path it will work and exclude this application from scanning?

Need to do this because application we have not always is installed in the same localization.

[btan]

Hi Pieciaq,

Yes, EMS support using character notations in defining the path.

I think you cannot use asterisk * in your scenario. Asterisk is for single folder only:
https://docs.tibco.com/pub/oiag/3.0.0/doc/html/GUID-5CC255A7-7DE7-4DFE-B128-A00E5E1AD27C.html#:~:tex....

Perhaps you can use percentage %.
https://learn.microsoft.com/en-us/previous-versions/troubleshoot/winautomation/product-documentation...

For example, if you want to exclude Google Chrome:
%programfiles%\google\chrome\

If it is an x86 application:

%programfiles(x86)%\companyname\application-folder-name

If you are unsure, you can always trial-and-error.
Open File Explorer, input anything %programfiles%\xxx, and see if Windows leads you to the correct folder.

[btan]

Below answer from chatGPT can be helpful :) 
We usually exclude the whole application path, not only the .exe