Intune - Package FortiClient Cloud .MSI with MST that contains Invite & Telemetry Codes

[Ju1ezz]

Is it possible to create a custom app package that contains the .MSI and a manifest file (.MST) with both the invite and telemetry codes? I have found a couple posts with command line arguments but they don't seem to work when running them on the my test device - it's still asking for both. Commands I've found on other posts:

C:\Program Files\Fortinet\FortiClient> FortiESNAC.exe -c REG_REG_TO_CLOUD -r <invite code>

FortiESNAC.exe -r ems-ip/FQDN -k telemetry-key <telemetry key>

Essentially, I'm attempting to do an org roll out via Microsoft Intune and using the documentation produced, I've only found solutions for mobile devices and need to roll out to PC's. I've created a custom MST under the Property table I've injected values "ems_key" for telemetry code and "invitation_code" for the invitation code. It seemed to have not worked. Do they require to be in a different table, or is this not possible?

install command: msiexec /i "FortiClient.msi" /qn TRANSFORMS=custom.mst

Any tips, help or guidance is much appreciated

[xshkurti]

@Ju1ezz 

Please check this link:

Configuring the FortiClient application in Intune | FortiClient 7.0.0 | Fortinet Document Library

It uses IntuneWinAppUtil.exe to create package.
Maybe this will help

[Ju1ezz]

Hi @xshkurti! thanks for replying here,

This is what I followed to create the .intune file for a Win32 app implementation into Intune - it will install the app perfectly on my test devices, however the MST I created and compiled with the MSI doesn't apply the invitation code, or the telemetry code sadly. That's the part I'm trying to figure out - it seems it could be done with a post-install script, but the commands I've found on here from others seem to not be working either 

[Ben4]

Hi,

Did this ever get resolved for you? I'm having the same issue!

[sjoshi]

Hi,

To create a custom app package containing the .msi and a manifest file (.mst) with both the invite and telemetry codes for a PC rollout via Microsoft Intune, you can use the following approach: Ensure that the custom.mst file includes the correct properties "ems_key" for the telemetry code and "invitation_code" for the invite code. When running the installation command, make sure to specify the transforms parameter correctly as "/qn transforms=custom.mst" to apply the customizations during the installation process. Verify that the properties are correctly defined in the custom.mst file and that the installation command is pointing to the correct file paths for FortiClient.msi and custom.mst. This method should allow you to customize the installation with the desired invite and telemetry codes for PC deployments.

[Ben4]

Hi,

Thanks for getting back. The install command is: msiexec /i "FortiClient.msi" TRANSFORMS="FortiClient.mst" /qn /Log C:\Temp\Forti.log

The MST was in the package I created, but doesn't seem to want to work. puzzling. 

[Lleawyn]

Replying to this thread since I just had to figure this out myself.
I think there's some confusion on this thread with the various invitation properties - these are for deploying FortiClient mobile (iOS/Android). Obviously, the .msi/.mst is Windows-based.
(see here - Enrolling FortiClient mobile endpoints to EMS with Intune integration | FortiClient 7.4.0 | Fortinet...)

FortiClient EMS gives you the option to build the custom installer with the invitation code included - it's just not in a very intuitive place. You have to build the installer as part of building the invitation.

To do so, click on the invitations button at the top right of the screen, then click "add".

While making the installer, be sure to select the option to include the .MSI files. The .mst file includes the invitation code and the connection key, but they're encrypted.

To confirm this, I opened the transform in Master Packager - it showed 3 changes from the normal .MSI:

1. feature install/visibility options
2. installation UID
3. addition of a "config" binary file that's not easily readable. The "invitation_code" and "ems_key" properties don't exist (at least not in FortiClient 7.2.9).

A nice advantage of this though - from what I can tell, after you've created the package, the same transform file can be used on any version of the .msi. Instead of needing to completely rebuild the installer with FortiClient, you can repackage the existing .mst with the updated .msi.

This was tested on 7.2.9 & 7.2.10 - I haven't looked at 7.4 at all yet.