Settings are locked by EMS

[bobm]

We're running a 90D with FW 5.2.11, and FortiClient 5.4.x on our users. Just one default FC profile for now, but probably more coming.  My issue is that I'm trying to get all users on the same FC rev without manually updating every one.  I'm trying to get the FGT to push updates out via compliance rules, but can't seem to get to them.  I can view them from the FC when I disconnect from the FGT, but they are greyed out. I can't seem to get non-compliance actions to show up in the profiles I try to set up either.

When I register with the FGT, the FC console says "settings are locked by EMS".  But we don't have an EMS, just the FGT.

A lot of this is in preparation to upgrade to OS 5.4.x in the near future as well - anything else I should be looking at?

Thanks

[Markus]

Hi Bobm, you should look at the changed licensing and management beginning mit FortiOs 5.4.2 to, see https://forum.fortinet.co...p;m=152834&mpage=1

Best,

Markus

[bobm]

Thanks Markus, actually just came across that.  Good to know!  Luckily all our contracts/licenses are coming up in November so this may work smoothly after all.

[SteveG]

From what I've seen Fortinet are reducing the ability of their gates to manage FortiClient and over time will remove this type of management capability from their firewalls. EMS seems to be the way to go, that does support push upgrades as we use that feature.