FortiClient unregistration password

[Suneelkumar]

Hi All,

can any one help for setting up the password for Forticlient when users try to unregistered from his computer.

we tried it doing in XML format and import it worked but after 2 to 3 minutes it will not ask passwords again we have to do

the import using command line for password fromte

below is the method

keep the XML in c:\temp\*****.conf

and put this command in command promt

c:\>cmd /c "c:\program Files\fortinet\FortiClient|FCConfig.exe" -o import -f C:\temp\***.conf

[Chris_Lin_FTNT]

When FortiClient registers, it will get the new config from FortiGate. You need to make sure that the password setting is also in the FortiGate config.

[Suneelkumar]

Thanks Chris,

can you help me how to do that one.

[Chris_Lin_FTNT]

Try this one:

config endpoint-control profile edit "default" config forticlient-winmac-settings

forticlient-settings-lock Enable/disable FortiClient settings lock. forticlient-settings-lock-passwd Password for FortiClient settings lock.

[Suneelkumar]

Hi,

i have enabled the forticlient-settings-lock enable

but still if i tried to do any changes like unregistered in forti client its not asking for any passwords

below is the configuration for your reference.

Suneel # show endpoint-control profile IT config endpoint-control profile     edit "IT"             config forticlient-winmac-settings                 set forticlient-av disable                 set forticlient-wf-profile "Normal Users"                 set disable-wf-when-protected disable                 set forticlient-settings-lock enable                 set forticlient-settings-lock-passwd ENC pPEMS61JF1yfFfZC4TtrGHMpPa+h+zvy/FTXPOuwcGC5T6Gd01X3LgUhbR+hXT/o3fbvwv0gIM73EnNEYGA13t4hxiI6oJtlMaEIINRRSMBOxANrpIGjUS/XPFPHu3nk9sTPOGyTjXPoCMWJsioZ+BucitIYDO25EnLGH6+SsZCl1AlEnN4b59Jp/NQ7okkJjSKegg==                 set forticlient-ui-options wf             end             config forticlient-android-settings             end             config forticlient-ios-settings             end         set device-groups "IT"     next end

Regards

Suneelkumar

[Chris_Lin_FTNT]

How many endpoint-control profile do you have? Is it possible that FortiClient got another profile instead of "IT"?

[rob_kowalski]

Hi Chris,

I am also trying to lock down the forticlients with a password. (5.4.1 fortigate, 5.4.1 forticlients)

The feature does not appear to be present:

config forticlient-winmac-settings

FG100D3G14821654 (forticlient-winm~ngs) # set

compliance-action FortiClient compliance action. forticlient-av Enable/disable FortiClient antivirus scanning. av-realtime-protection Enable/disable FortiClient antivirus real-time protection. av-signature-up-to-date Enable/disable FortiClient AV signature updates. sandbox-analysis Enable/disable sending file to FortiSandbox for analysis. forticlient-application-firewall Enable/disable FortiClient application firewall. forticlient-system-compliance Enable/disable enforcement of FortiClient system compliance. forticlient-wf Enable/disable FortiClient web category filtering. forticlient-vuln-scan Enable/disable FortiClient vulnerability scan.

FG100D3G14821654 (forticlient-winm~ngs) # set forticlient-settings-lock enable

command parse error before 'forticlient-settings-lock' Command fail. Return code -61

[Chris_Lin_FTNT]

Yeah... many features are gradually moving to EMS...

[rob_kowalski]

Hi Chris thanks for your prompt reply :)

So no way to do it from fortigate?

How would you recommend we lock down the forticlients so the users do not try to uninstall or disable AV?

Rob

[Chris_Lin_FTNT]

I think you can use EMS, which is the trend that Fortinet is pushing... Or downgrade FortiOS to 5.4.0 (at least you have "forticlient-advanced-cfg")?