Windows Update fails and performance degradation when FortiClient Sandbox profile is enabled EMS

[choil]

Hello community,

• We are currently running Forti EMS Cloud 7.4.3 with several endpoint versions, mainly FortiClient 7.2.11 y 7.0.X on Windows 11 devices.
• We are working together with the customer and Microsoft support to troubleshoot an issue where Windows Update downloads do not complete and the update process becomes extremely slow or stuck.

Issue Description:

• When endpoints have a FortiClient profile with Sandbox enabled, Windows Update shows the following symptoms:

1. Update download does not complete

If we change the endpoint policy to Default profile (no Sandbox), the Windows Update process completes successfully.

Tests Performed

To verify this behavior, we performed the following tests:

• Disabled Sandbox profile → Windows Update completes normally
• Re-enabled Sandbox profile → Windows Update fails or hangs
• We tested with multiple Windows Update components excluded:

1. TrustedInstaller.exe
2. TiWorker.exe (Windows Modules Installer Worker)
3. DISM.exe
4. C:\Windows\WinSxS\
5. C:\Windows\SoftwareDistribution\

• Even with these exclusions, the issue persists.
• This strongly indicates that the FortiClient Sandbox module or its interaction with EMS Cloud 7.4.3 is affecting Windows Update performance or blocking the process.

Request

Has anyone experienced similar behavior with:

• EMS 7.4.x
• FortiClient 7.2.x
• Sandbox Cloud enabled
• Windows Update performance issues?

We would appreciate guidance on:

• Recommended compatibility settings
• Additional exclusions required

Thanks in advance for any insight or recommendations

[AEK]

Hi Choil

Try upgrade at least one client to the latest possible 7.4.x (in your case 7.4.3) and see if it helps.

[Mx2]

Try Forticlient 7.4.4, it fixed this issue in our case.

[neil46]

All our customers facing this, including ourselves, have one thing in common: the sandbox is enabled. I've now disabled this feature, be it cloud or a local sandbox. I'll try to keep you updated. Maybe you can test the same if the company policy allows for it?

[choil]

Yes, disabling the Sandbox profile allows the Windows update to work. However, this is not an option due to company policy.

[AEK]

Just as a troubleshooting step, can you try exclude the whole C:\Windows\ and share the result?

[choil]

I'm going to test it and I'll let you know about this exclusion and later if it updates to 7.4.4 of Forticlient.