Forticlient slowing down Windows 11 update 24h2

[rgs-araujo]

Hello there,

We are having issues on machines trying to update to the last windows 11 update 24h2.

The updates are taking way too long, some of them taking 5 hours to complete. Our machines all have SSDs installed, so, don't think it is an I/O issue.

We tested machines without forticlient and they finished updating in about 10 minutes.

Our forticlient versions are 7.2.4.0972 and 7.2.5.1053 (tested in both of them and the issue persists).

I tried disabling Cloud based protection and refining antivirus exclusions, to no avail. Exclusions are as follows:

Paths:

%windir%\SoftwareDistribution\Datastore
%systemroot%\System32\Spool

Files:
%windir%\Security\Database\*.log
%windir%\Security\Database\*.sdb
%windir%\SoftwareDistribution\Datastore\Logs\Edb.chk
%windir%\SoftwareDistribution\Datastore\Logs\Tmp.edb
%windir%\Security\Database\*.chk
%windir%\Security\Database\*.jrs
%windir%\Security\Database\*.csv
%windir%\Security\Database\*.edb
%windir%\Security\Database\*.xml
%windir%\SoftwareDistribution\Datastore\Logs\Edb*.jrs
%windir%\Security\Database\*.cmtx
C:\pagefile.sys
C:\swapfile.sys
C:\hiberfil.sys
%allusersprofile%\NTUser.pol
%Systemroot%\system32\GroupPolicy\registry.pol

I collected some logs from a machine that took almost 4 hours to complete the update (from october 3rd, 10:40 to 14:05). I couldn't find any explanation for what I found. Some entries I repeatedly see on these logs are:

03/10/2024 11:17:29 debug update update process sending request: 07002000FVDB01300000920772499999 ##this numer seems random.

03/10/2024 11:59:58 debug av <appdbClient.msg 6> [file: , pid: 0]
03/10/2024 12:00:34 debug firewall scheduler called us