Forticlient Endpoint Protected Process Service not started

[SteveJW]

We migrated from Forticlient 7.2.13 to 7.4.4. ESXi VM appliance.
I recently noticed that the Forticlient Endpoint Protected Process Service on our servers is set to automatic, but hasn't started.
The service is started on our Windows 10/11 workstations.

The SSL/IPSec VPN feature isn't installed on the servers.
This was also the case in the previous version, but then the Forticlient Endpoint Protected Process Service was started.

When I start the service manually on the servers, I get the following message:

Forticlient 7.4.4 seems to be working properly on the servers, even though this service isn't started.

What is the function of this service, and does it need to be started?

[Anthony_E]

Hello Steve,

To address the issue of the FortiClient Endpoint Protected Process service not starting, follow these steps:

1. Check Service Status:

   • Open the Windows Services management console by typing services.msc in the Run dialog (Windows key + R).
   • Locate the "FortiClient Endpoint Protected Process" service.
   • Check if the service is set to "Manual" or "Automatic" and attempt to start it manually.

2. Verify Administrative Privileges:

   • Ensure you are logged in with an account that has administrative privileges, as starting certain services may require elevated permissions.

3. Review System Configuration:

   • Open the System Configuration tool by typing msconfig in the Run dialog.
   • Under the "Services" tab, ensure that the FortiClient services are enabled.

4. Check for Conflicting Software:

   • Verify if any other security or endpoint protection software is installed that might conflict with FortiClient. Temporarily disable or uninstall such software to see if the service starts.

5. Reboot in Diagnostic Mode:

   • In the System Configuration tool, select "Diagnostic Startup" under the General tab and reboot the computer. This mode loads only basic devices and services, which can help identify if a third-party service is causing the issue.

6. Reinstall FortiClient:

   • If the issue persists, consider uninstalling and then reinstalling FortiClient to ensure all components are correctly installed.

If these steps do not resolve the issue, further investigation into system logs or contacting Fortinet support may be necessary.

[SteveJW]

Hi Anthony,

I created a ticket with Fortinet support.
Their response:
This service, responsible for antivirus registration to Windows Security Center, does not exist on any servers.
To resolve the issue, could you please try reinstalling FortiClient? We had a similar report previously, and simply reinstalling it solved the issue.

And they're right. Reinstalling FortiClient is the solution.
Steps:
1) Disconnect Forticlient
2) Shutdown Forticlient
3) Uninstall Forticlient via Programs and Features
4) Restart

Despite the steps above, the Forticlient Endpoint Protected Process & FortiClient Service Scheduler services were not removed.

However, after reinstalling Forticlient, the Forticlient Endpoint Protected Process service started automatically.

I don't want to perform this manual action on approximately 40 servers.
I also don't see any CLI parameters to automate this via a (PowerShell) script, or am I missing something?

I ask Fortinet if there is a hotfix available I can install to solve this issue?
waiting for response

[Mx2]

I have reported this same issue to Fortinet as well. This comes up randomly every now and then, when we are upgrading FCT to new version. We haven't found any other solution than to perform a "clean install" - remove old FCT version first and install new one fresh. This seems to fix the issue.

[SteveJW]

Were you able to automate this reinstallation, or was it a manual process?

As I mentioned, I don't see any issues on the servers, even though the Endpoint Protected Process Service isn't running.
Is it a problem to leave it as is and hopefully fix it with the next upgrade?

[Mx2]

We have automated reinstallations/upgrades using Microsoft Configuration Manager. It's just a script that removes FCT, reboots, install FCT back and reboots once more. 

AFAIK the process is not necessary to have running on the servers. 

[loferialopez5]

Interesting issue! Sometimes services behave differently on servers vs. workstations. While troubleshooting, I often test related apps using tools like crossover mac full version to ensure everything runs smoothly across environments before digging deeper.