Forticlient 7.2.7 breaks Windows Login Screen

[ULSJim]

So I have a few laptops in our organization that this has happened to now, I originally thought it was the most windows update that did it as both users advised that issue started occurring after a windows update.  But after experimenting with one of the laptops I have wiped it multiple times now (as issue kept reappearing) my tests I started installing things one by one and rebooting.  I started with our 7.2.5 installer and had no issue, but when I updated to 7.2.7 is when issue resurfaced. I then created a 7.2.7 installer wiped the laptop and first thing I did after joining our domain was install forticlient 7.2.7 and it issue immediately happened.  

When the issue occurs the login screen flashes every few seconds and resets to the initial screen, it is painstaking to just reboot it into maintenance mode to use the recovery drive.  It has happened on 2 different model of laptops (Surface Laptop 6 and Asus Expert Book) I have a bunch of laptops that are just fine running 7.2.7 on both models of these laptops. 

I haven't been able to find anyone else having this issue and I am guessing it is some weird rare situation that is cause its only been 2 of 75 of our laptops that it has happened to but if I can't find fix for this it basically makes 2 of my laptops unusable.

Anyone else run into this or have a fix for it?

[WG-JW · Accepted solution]

Hi,

not an actual solution but it helped working around the flashing login screen getting people back to work.

We've experienced the same, using v7.2.7.1116 and used the "FortiClient Endpoint Management Server" to downgrade to lower a version, by creating a new workgroup within "Endpoints", adding affected devices and assigning the deployment.

Necessary parameters:

• unnattended installation - unchecked
• Reboot when no user logged in - checked

kind regards!

[ULSJim]

You are a life saver!  I didn't actually think of being able to use the EMS system for this, it wouldn't have saved me the hours finding that the forticlient was culprit but could have me some time after I did.   Thank you very much for this, if you find the actual solution for issue please let me know I can at least run these machines on the older version for now.

[Jurok89]

I had exact same problem. I had to create Live Windows on USB drive. Run the live Windows, access disk with original Windows installed and renamed the file from Fortinet to something else. After that I was able to login again to my Windows.

[UnknownUser_AT]

Have the same issue on Lenovo devices, 3 devices of the same model have the issue but one device with the exact same installation doesn't have it - only difference is that the one without the issue has windows hello for business configured, the others not.

Tried to reinstall one of the laptops with issues already, still same issue, with 7.2.6 all is working fine, after upgrade (or fresh install) of 7.2.7 the issue starts after second reboot.

All devices have Win11 23H2 installed, don't have a Win10 22H2 currently to test. On 2 other Lenovo models i don't have the issue at all. Bios settings are the same too.

That's logged in the eventlog:

Faulting application name: LogonUI.exe, version: 10.0.22621.1, time stamp: 0xcf0f816d
Faulting module name: FortiCredentialProvider2.dll, version: 7.2.7.1116, time stamp: 0x6757c9b9
Exception code: 0xc0000005
Fault offset: 0x0000000000135c23
Faulting process id: 0x0x23B0
Faulting application start time: 0x0x1DB51F2302FB3CB
Faulting application path: C:\Windows\system32\LogonUI.exe
Faulting module path: C:\Program Files\Fortinet\FortiClient\FortiCredentialProvider2.dll
Report Id: 853cad7b-33ad-441e-9a11-d6920da40188
Faulting package full name:
Faulting package-relative application ID:

[PascalLeroux]

We began our pilot phase for the 7.2.7.1116 and we got the issue on 3 Lenovo.  L15 and E16.

All 3 are at last Windows 10 22H2 patch.  

L15 is a fresh install, both E16 are upgrade from a previous Forticlient version.

Not sure what could be the "trigger" because we got some E16 or L15 without issue.

[ITGuy12]

A workaround that fixed it for us.  Disable "Show VPN before Logon" on the remote access profile/policy.  This fixed the issue on the few machines we had this issue on.

[ULSJim]

Sadly this isn't an option for us as our Yubikey's occasionally need vpn connected to renew their security certs with the CA on the domain.

[Chey]

Interestingly most of the people on here report they are using lenovo - any other machine affected ?

Contact you Fortinet account or Support and ask about - internal report ID 1112112/1027199 it's a known issue which their dev's know about but they are not releasing the details only recommendation is upgrade to 7.2.8..... poor show..

[ULSJim]

It happened to our Microsoft Surface (Pro and Laptops) and ASUS laptops, Support just said it is some bug with the VPN before login and told me to upgrade to 7.2.8 that just came out that so far has fixed the few test machines I have run it on.  It isn't even listed in any of their known bugs or fixed bugs which is definitely poor service since they say its a known bug which makes me worried it will happen again.  Even more worrying is fact those machines were running over a month without an issue and then they one day just started encountering the problem with no change on our end.