Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
aklinden
New Contributor

Fortishield.sys BSOD on Windows 10 22H2 and 22H1 machines

Multiple stop codes -

DRIVER_IRQL_NOT_LESS_OR_EQUAL

REGISTRY_FILTER_DRIVER_EXCEPTION

ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY

 

All of these show Fortishield.sys as what failed. 

 

We recently updated from Forticlient 7.0.8 to 7.0.9.0493, but this happened on several machines with the previous upgrade from 7.0.7 to 7.0.8. 

 

Seems to be effecting exiting machines (Dell/Lenovo environment, but no Lenovo's have reported issues) as well as newly imaged machines, but there's no common factor. Most of the machines in our environment aren't having an issue, but we've gotten a number of reports. When we image a new machine, it may or may not happen so other than an update, nothing has changed. 

 

I've seen a previous forum post for this where the solution was disabling an antivirus. We use Arctic Wolf for vulnerability scanning and MECM for managing endpoint protection via Windows Defender, but no third-party AV. 

 

Troubleshooting tried so far - 

Uninstalling/reinstalling Forticlient - verifying that Fortishield.sys is no longer found in C:\Windows\System32\drivers\ during the process. 
DISM /Online /Cleanup-Image /RestoreHealth and SFC /scannow

All OEM drivers are up to date outside of Nvidia drivers (for compatability)

I've manually uninstalled all Forticlient drivers from Device Manager and then reinstalled Forticlient.

 

All of this has resulted to less frequent BSOD reports, but hasn't resolved the issue. I've also checked the known issues page for 7.0.9, but this issue doesn't seem to be present. 

 

Please let me know if you've got any suggestions. 

4 REPLIES 4
kcheng
Staff
Staff

Hi @aklinden 

 

I manage to observe a few other customers having the same issue. Do you have a valid FortiClient EMS support contract? It would be good to log a case with our FortiClient team so that they can check the respective internally.

Cheers,
Kayzie Cheng

If you have found a solution, please like and accept it to make it easily accessible for others.
jiahoong112
Staff
Staff

Please try to download the FortiClientTools from support.fortinet.com and run the Uninstaller. After uninstallation + reboot, do a clean install of Forticlient version 7.0.9 and monitor. Alternatively, you can try using Forticlient version 7.2.

**If you come across a resolution, kindly show your appreciation by liking and accepting it, ensuring its accessibility for others**
aklinden

I'll give this a shot and follow up here. Thanks for the suggestion. 

 

Out of curiosity, do you know what this tool does different than a normal uninstall/reinstall?

aklinden

I was able to find the tool and uninstall/reinstall. User has just reported another BSOD, fortishield.sys as the cause. 

Top Kudoed Authors