Remove Option to Disable Web Filter and Application Firewall

[kalarse]

Hello all,

How are you?

We are trying to deploy FortiClient 5.6 in order for some users work outside Office Hours and the issue we are running in is that though we were able to ensure they won't be able to disconnect the client from the Firewall through Compliance, we are unable to make sure those users won't Disable the Web Filter and Application Firewall, as we want to make sure those notebook will only be used to work, nothing else.

As noted in screenshot above, we want to remove the Disable option. In the conf files I haven't found (yet) said option.

and the ones I found (<display_webfilter>, <display_firewall>), though I set them to "0" (I saw them as "1"), still displays said option (even after restarting computer).

I hope you could help me, thanks and best regards.

[neonbit]

If you're using EMS server to manage these FortiClients then you can enable the 'Password Lock Configuration' option found under System Settings. This will require a password to be entered when they want to disable any feature.

Also worth enabling the 'Disable Unregister' option so they can't unregister from the FortiGate and disable these features.