EMS Administration Guide

• Introduction
  • FortiClient EMS components
  • Documentation
• Getting started
  • Getting started with managing Windows, macOS, and Linux endpoints
    • Deploying FortiClient software to endpoints
    • Pushing configuration information to FortiClient
    • Relationship between FortiClient EMS, FortiGate, and FortiClient
      • FortiClient in the Security Fabric
      • FortiClient with EMS
      • Quarantining an endpoint from FortiOS using EMS
  • Getting started with managing Chromebooks
    • Configuring FortiClient EMS for Chromebooks
    • Configuring the Google Admin console
    • Deploying a profile to Chromebooks
    • How FortiClient EMS and FortiClient work with Chromebooks
• Installation preparation
  • System requirements
  • License types
    • FortiClient EMS
      • Free trial license
      • Windows, macOS, and Linux licenses
      • Chromebook licenses
    • Component applications
  • Required services and ports
  • Management capacity
    • Hardware configuration when EMS and SQL Server run on same machine with no FortiGate connected
    • Hardware configuration when EMS and SQL Server run on different machines with no FortiGate connected
    • Hardware configuration when FortiGates are connected to EMS
  • FortiClient Telemetry security features
  • Server readiness checklist for installation
  • Upgrading from an earlier FortiClient EMS version
  • Install preparation for managing Chromebooks
• Installation and licensing
  • Downloading the installation file
  • Installing FortiClient EMS
    • Installing FortiClient EMS to specify SQL Server Enterprise or Standard instance
  • Installing FortiClient EMS using the CLI
    • Allowing remote access to FortiClient EMS and using custom port numbers
    • Customizing the SQL Server Express install directory
  • Starting FortiClient EMS and logging in
  • Configuring EMS after installation
  • Licensing FortiClient EMS
    • Licensing EMS by logging in to FortiCloud
    • Uploading a license file
    • Licensing EMS in an air-gapped network
    • License status
    • Help with licensing
  • Specifying different ports
  • Upgrading Microsoft SQL Server Express to Microsoft SQL Server Standard or Enterprise
  • Uninstalling FortiClient EMS
  • Installation and setup for managing Chromebooks
    • Google Admin Console setup
      • Logging into the Google Admin console
      • Adding the FortiClient Web Filter extension
      • Configuring the FortiClient Web Filter extension
      • Adding root certificates
        • Communication with the FortiClient Chromebook Web Filter extension
        • Communication with FortiAnalyzer for logging
        • Summary of where to add certificates
        • Uploading root certificates to the Google Admin console
      • Disabling access to Chrome developer tools
      • Disallowing incognito mode
      • Disabling guest mode
      • Blocking the Chrome task manager
      • Verifying the FortiClient Web Filter extension
    • Service account credentials
      • Configuring default service account credentials
      • Configuring unique service account credentials
        • Creating unique service account credentials
        • Adding service account credentials to the Google Admin console
        • Adding service account credentials to EMS
  • Verifying ports and services and connection between EMS and FortiClient
• GUI
  • Banner
  • Left pane
  • Content pane
• Dashboard
  • Viewing the Status
    • System Information widget
    • License Information widget
    • Status charts and widgets
  • Viewing the Vulnerability Scan dashboard
    • Viewing current vulnerabilities
    • Viewing the Endpoint Scan Status
    • Viewing the top 10 vulnerable endpoints with high risk vulnerabilities
    • Viewing top ten vulnerabilities on endpoints
  • Viewing Chromebook Status
• Endpoint management
  • Windows, macOS, and Linux endpoints
    • Managing groups
    • Adding endpoints
      • Adding endpoints using an AD domain server
      • Connecting manually from FortiClient
    • Viewing endpoints
      • Viewing the Endpoints pane
      • Using the quick status bar
      • Viewing endpoint details
      • Filtering the list of endpoints
      • Using bookmarks to filter the list of endpoints
      • Viewing Sandbox event details
      • Sending endpoint classification tags to FortiAnalyzer
    • Managing endpoints
      • Running AV scans on endpoints
      • Running vulnerability scans on endpoints
      • Patching vulnerabilities on endpoints
      • Uploading FortiClient logs
      • Running the FortiClient diagnostic tool
      • Updating signatures
      • Downloading available FortiClient logs
      • Downloading available diagnostic results
      • Disconnecting and connecting endpoints
      • Quarantining an endpoint
      • Quarantining an endpoint from FortiOS using EMS
      • Excluding endpoints from management
      • Deleting endpoints
  • Group assignment rules
    • Group assignment rule types
    • Managing group assignment rule priority levels
    • Adding a group assignment rule
    • Enabling/disabling a group assignment rule
    • Deleting a group assignment rule
  • Google Domains
    • Adding a Google domain
    • Viewing domains
      • Viewing the Google Users pane
      • Viewing user details
    • Editing a domain
    • Deleting a domain
• Deployment & Installers
  • Manage Deployment
    • Preparing the AD server for deployment
      • Configuring a group policy on the AD server
      • Configuring required Windows services
      • Creating deployment rules for Windows firewall
      • Configuring Windows firewall domain profile settings
    • Preparing Windows endpoints for FortiClient deployment
    • Creating a deployment configuration
    • Managing deployment configuration priority levels
    • Enabling/disabling a deployment configuration
    • Deleting a deployment configuration
    • Deploying initial installations of FortiClient (macOS)
    • Deploying FortiClient upgrades from FortiClient EMS
    • Deploying different installer IDs to endpoints using the same deployment package
  • FortiClient Installer
    • Adding a FortiClient deployment package
    • Viewing deployment packages
    • Deleting a FortiClient deployment package
• Endpoint Policy & Components
  • Manage Policies
    • Adding an endpoint policy
    • Editing an endpoint policy
    • Deleting an endpoint policy
    • Enabling/disabling an endpoint policy
    • Managing endpoint policy priority levels
    • Editing endpoint policy view
    • Managing FortiClient based on AD user/user groups
  • CA Certificates
  • On-fabric Detection Rules
• Chromebook Policy
• Endpoint Profiles
  • Editing a default profile
  • Creating a new profile
  • Adding a new Chromebook profile
  • Managing profiles
    • Editing a profile
    • Cloning a profile
    • Syncing profile changes
    • Editing sync schedules
    • Exporting a profile
    • Importing a profile
    • Deleting a profile
  • Remote Access
    • SSL VPN
    • IPsec VPN
    • Configuring a profile with application-based split tunnel
    • Configuring a profile to allow or block endpoint from VPN tunnel connection based on the applied Zero Trust tag
    • Configuring a backup VPN connection
    • Using a browser as an external useragent for SAML authentication in an SSL VPN connection
    • Per-machine prelogon VPN connection without user interaction
    • Autoconnect on logging in as an Entra ID user
  • ZTNA Destinations
  • Web Filter
    • Importing a Web profile from FortiOS or FortiManager
    • Enabling and disabling Safe Search
    • Support banned word check in URL
  • Vulnerability Scan
  • Malware Protection
  • Sandbox
  • Firewall
  • System Settings
    • Configuring identity compliance for endpoints
  • XML Configuration
    • Creating a profile with XML
    • Importing a profile from an XML file
    • Configuring encrypted ZTNA rules
• Zero Trust Tags
  • Zero Trust Tagging Rules
    • Adding a Zero Trust tagging rule set
    • Editing a Zero Trust tagging rule set
    • Deleting a Zero Trust tagging rule
    • Importing and exporting a Zero Trust tagging rule set
    • Uploading signatures for FortiGuard Outbreak Alerts service
    • Managing tags
    • Zero Trust tagging rule types
  • Zero Trust Tag Monitor
  • FortiOS dynamic policies using EMS dynamic endpoint groups
    • Configuring FortiOS dynamic policies using EMS ZTNA tags
    • Restricting VPN access to rogue/non-compliant devices with Security Fabric
  • Fabric Device Monitor
• FortiGuard Outbreak Alerts
• Software Inventory