Fortishield.sys BSOD on Windows 10 22H2 and 22H1 machines

[aklinden]

Multiple stop codes -

DRIVER_IRQL_NOT_LESS_OR_EQUAL

REGISTRY_FILTER_DRIVER_EXCEPTION

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

All of these show Fortishield.sys as what failed. 

We recently updated from Forticlient 7.0.8 to 7.0.9.0493, but this happened on several machines with the previous upgrade from 7.0.7 to 7.0.8. 

Seems to be effecting exiting machines (Dell/Lenovo environment, but no Lenovo's have reported issues) as well as newly imaged machines, but there's no common factor. Most of the machines in our environment aren't having an issue, but we've gotten a number of reports. When we image a new machine, it may or may not happen so other than an update, nothing has changed. 

I've seen a previous forum post for this where the solution was disabling an antivirus. We use Arctic Wolf for vulnerability scanning and MECM for managing endpoint protection via Windows Defender, but no third-party AV. 

Troubleshooting tried so far - 

Uninstalling/reinstalling Forticlient - verifying that Fortishield.sys is no longer found in C:\Windows\System32\drivers\ during the process. 
DISM /Online /Cleanup-Image /RestoreHealth and SFC /scannow

All OEM drivers are up to date outside of Nvidia drivers (for compatability)

I've manually uninstalled all Forticlient drivers from Device Manager and then reinstalled Forticlient.

All of this has resulted to less frequent BSOD reports, but hasn't resolved the issue. I've also checked the known issues page for 7.0.9, but this issue doesn't seem to be present. 

Please let me know if you've got any suggestions. 

[kcheng]

Hi @aklinden 

I manage to observe a few other customers having the same issue. Do you have a valid FortiClient EMS support contract? It would be good to log a case with our FortiClient team so that they can check the respective internally.

[jiahoong112]

Please try to download the FortiClientTools from support.fortinet.com and run the Uninstaller. After uninstallation + reboot, do a clean install of Forticlient version 7.0.9 and monitor. Alternatively, you can try using Forticlient version 7.2.

[aklinden]

I'll give this a shot and follow up here. Thanks for the suggestion. 

Out of curiosity, do you know what this tool does different than a normal uninstall/reinstall?

[aklinden]

I was able to find the tool and uninstall/reinstall. User has just reported another BSOD, fortishield.sys as the cause.