Windows 10 Action Center repeatedly shows notices whenever FortiClient updates or scans.

[AlexRG]

It seems whenever FC updates its databases, it briefly "turns off" according to Windows, which prompts a notification. It shows every minute or so while scanning, and if you watch Action Center while it's doing so, the AV status 'flickers' between on and off. Has anyone else had this/have a solution for it?

[Mark_Holtkamp · Accepted solution]

Same here, I've removed antivirus from our FortiClient profile for now for that reason. It drove users insane and promoted unsafe behavior.

[AlexRG]

I did up a gif of the action: [link]https://streamable.com/wazq[/link]

[tanr]

Which FortiClient version are you seeing this with?

If you haven't already, please open a ticket with to report it.

[AlexRG]

This is with 5.4.1.0840. I have indeed raised a ticket and will update this thread with any details I get. So far the technician has been unable to repro it in his lab.

Update: We got it to occur while doing a GoTo. It seems that the two processes fmon.exe and FCWscD7.exe (Windows Security Center Helper) are repeatedly stopping and starting when it's happening. We disabled Realtime scanning for a debug and it hasn't done it yet after 30 minutes. [strike]I'm wondering if the Forticlient directory just needs to be put in the directory whitelist[/strike] (no effect) or something along those lines.

[bobm]

I'm seeing the same thing.

We're running both Windows 10 1511 and Anniversary Update 1607 with Forticlient 5.4.0 and 5.4.1.   Last Friday while either an update or scan was going on, users had the Action Center popup about every 3-4 seconds for quite some time. 

Apparently still no word/fix from Fortinet, but one thing that at least quieted down the notifications was activating "Quiet Hours" in Windows.  Right click on the bottom right text box looking Action Center icon and it's one of the options there.  They still fill up the Action Center if you open it, but at least it doesn't constantly interrupt users, and you don't have to disable the features (at least for me) that were the main reason to use FC in the first place.