Windows updates fails with enabled Forticlient

[MarkusKoehler]

Since last week we experiencing a lot of problems with Windows updates (mostly Windows 11, but there was one Windows 10 among them as well), specifically KB5040442. On about 10% of our Windows clients the update would start and go until 96% and stay there for 10-60 minutes, and then after a restart Windows would tell us that something did go wrong and it would reverse the update. This would require multiple restarts and anything in the order of 2-10h. The usual information sources did not reveal anything unusual with this update round, so it had to be some uncommon conditions here.

When Windows was back online, it would sometimes (!) show an error code 0x800f0922, oftenly nothing, and on next restart it would try to install it again (and our employees losing again 4-10h with a working computer). First remedy, as described in the error code was to increase the size of the recovery partition to at least 250MB, but that helped only on one computer. No other things related to the code did apply to us or help. DISM and SFC sometimes would find something, but did not help in fixing the issues with the update. Over time some of the computers randomly succeeded in installing the update.

Last straw I had was to disable and uninstall Forticlient. And with that so far all of the clients went through the update without a hitch. Now I am anxious that it will return with the next update when I reinstall Forticlient. In retrospective, two computers had some troubles with some previous updates, but we re-installed Windows on them. Both were also affected this time.

What should be do and how can we prevent that from happening again? Is there anything to further debug and diagnose this issue?

For your reference we use Forticlient 7.2.4.0972 with EMS, and a Fortigate 200F as main firewalls. We have the web filter, AV and real-time protection enabled, as well as Anti-malware, Anti-Exploit and Cloud-base malware protection.

Thank you in advance for your help.

Regards,

Markus

[rgs-araujo]

Hi Arahman, thanks for the reply.

But I think the link you gave (vpn stops working after windows update) doesn't seem to be related to the issue in this thread (windows update fails or takes too long).

[awiesel]

Hello arahman,

I am a colleague of MarkusKoehler. Our problem does not seem to be related to the VPN. Both in-house clients (on-fabric, SSL VPN off) and clients connected via VPN have the problem.

The problem still persists with Windows 11 24H2 and FortiClient 7.2.5. One of our computers tried to install the October cumulative update four times without success and rolled back for two hours on a Dell Vostro with i7, 16GB and SSD. After disabling FortiClient Malware Protection completely via EMS, updates installed smooth within five minutes. This happened yesterday.

Support already had a look on the issue (see Ticket #9947946) and got detailed debug logs from us. They advised us to disable cloud protection in the forti client, without any success as it seems.

The situation is very frustrating for our users and even causes some damage, since a rollback usually takes at least one hour and the machine is not usable in that time, if we are not reachable to disable FortiClient. If you have any further information or instructions for troubleshooting, please let us know. I will try to grab the Windows update error code from the machine as soon as I can get my hands on it.

[VinceMoon]

It's still plaguing us as well. Moving the machine to a profile in EMS that doesn't "do" as much does seem to help, although that's not addressing the root cause. There was a bug listed in forticlient 7.4 (bug id 1022885 "Forticlient causes bootup delay on Windows 10 and 11) in New known issues but no mention of it on the 7.4.1 known issues or new issues document. I also note the MS release health issue WI893288 which may be related. Have you reviewed your CBS.log?

I'm updating Microsoft Visual c++ 2015 2022 redistributable to the latest version as well for good measure, as the version of the 2017 redistributable that is included in the FortiClientTools zip file is older than the one in the latest Microsoft Visual c++ 2015 2022 redistributable update.

[VinceMoon]

I also found this topic which sounds similar Forticlient slowing down Windows 11 update 24h2 - Fortinet Community

[awiesel]

Thank you for the tip with the CBS log. Due to the size of the logs, I had it analyzed by ChatGPT. All it found was a collision of some registry values:

• 2024-11-06 09:17:28, Info CSI 0000005c Warning: Overlap: Registry value collision found under key \\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Record\\{9E5C3C99-D046-3FE5-9921-21CF0F0A08FF}\\4.0.0.0\\ for Assembly, only one component should set this value

• 2024-11-06 09:17:28, Info CSI 0000005f Warning: Overlap: Registry value collision found under key \\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Record\\{9E5C3C99-D046-3FE5-9921-21CF0F0A08FF}\\4.0.0.0\\ for RuntimeVersion, only one component should set this value

• 2024-11-06 09:17:28, Info CSI 00000062 Warning: Overlap: Registry value collision found under key \\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Record\\{9E5C3C99-D046-3FE5-9921-21CF0F0A08FF}\\4.0.0.0\\ for Class, only one component should set this value

• 2024-11-06 09:17:28, Info CSI 00000065 Warning: Overlap: Registry value collision found under key \\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Record\\{8CF0278D-D0AD-307D-BE63-A785432E3FDF}\\4.0.0.0\\ for RuntimeVersion, only one component should set this value

• 2024-11-06 09:17:28, Info CSI 00000068 Warning: Overlap: Registry value collision found under key \\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Record\\{8CF0278D-D0AD-307D-BE63-A785432E3FDF}\\4.0.0.0\\ for Assembly, only one component should set this value

According to ChatGPT, this key might be controlling access to the clipboard for .NET applications. Seems a little bit odd to me that this is crashing a Windows Update with FortiClient on.

Good news is, we have a client that fails reproducible when FCT is on. I sent the logfiles of the FCT to the support. Lets see what they figure out.

[VinceMoon]

Thanks for the reply. I can also confirm we are also seeing the same issue on the November update too.

I also see many (hundreds) value collision entries in my cbs.log files. Maybe we are using similar software or hardware. You can DM me if you want and maybe we can talk in more detail.

Great news that's you've got a client to test on, can't wait for this to be put to bed. Would you mind sharing your ticket number so I can also raise my own and ask them to reference yours?

[awiesel]

Good morning VinceMoon,

our first ticket on the issue was 9947946 from Sep/Oct, but that one is closed after Fortinet concluded to turn off cloud protection and retry. Unfortunately, that didn't help. The recent ticket is 10076718, Fortinet is analyzing the logs right now.

[IHaveAProblem]

We are also facing this issue and I know of one other company with the same symptoms. Our last Fortinet case was dragging on for too long and it was hard to reproduce on demand so it was closed. I hope you have better luck and would love to know the root cause. I personally don't have a good experience with Forticlient.

[awiesel]

Good morning IHaveAProblem and VinceMoon,

the Forti support just responded us and they have no idea what might cause the issues. No obvious hints in the debug logs. We shall try FCT 7.2.6 and asked if some Sophos products are installed. If 7.2.6 won't help, they want to involve the dev team.

Beside that, we figured that it seemed to help when you disable all network traffic related components. In our case, this was web filter, video filter, sandbox and firewall. Maybe you could try this on the upcoming patchday.

Regards

Arne

[psevca]

Hello,

the issue was reported to the engineering team today using the details from the original reporter "Markus Koehler" and the TAC ticket that was created for the same issue within TAC EMEA Team.

regards

Peter