Appendix - FortiClient EMS services
The following lists FortiClient EMS services:
Critical severity
|
Service |
Description |
|---|---|
| FCEMS_Monitor | Ensures EMS services are running and restarts the ones that are down. It also can restart running services when it detects settings that affect those services have changed to ensure they use the latest settings. |
| FCEMS_Apache | Serves the EMS Administration console and APIs that FortiOS uses to get information on endpoints and posture. |
| FCEMS_Das | Allows most processes to access and cache endpoint-related data related. When down, processing of requests from endpoints results in error. |
| FCEMS_ZTNA | Provides some APIs that FortiOS consumes to get information on endpoints and posture. |
| FCEMS_ECSOCKSRV | Receives connections from endpoints and routes their requests to other processes within EMS. If this process is down, endpoints cannot communicate with EMS. |
| FCEMS_KA | Processes heartbeat requests from endpoints and is responsible for pushing profile changes and commands to execute on endpoints, such as vulnerability and antivirus (AV) scans. |
| FCEMS_REG | Handles registration requests from endpoints. |
| FCEMS_Notify | Notifies FortiOS when there are important changes in endpoints. |
| FCEMS_PROBE | Handles probe requests, which are tests that endpoints perform to ensure they are talking to a supported EMS. When this service is down, new endpoints cannot connect to EMS and existing endpoints cannot reconnect. |
| FCEMS_TAG | Processes network change requests from endpoints. When down, network changes that affect the endpoint's posture may take longer for EMS to realize and informed FortiOS of. |
| FCEMS_ChromebookServer | Processes requests and serves profiles to Chromebook endpoints. |
Medium severity
Low severity
|
Service |
Description |
|---|---|
| FCEMS_ADEVTSRV | If syncing AD information to EMS using a remote connector, this process parses the connector's requests. |
| FCEMS_FORENSICS | Integrates with the Forensics platform to pull updates from Forensics tickets associated with any managed endpoint. |
| FCEMS_MDMPROXY | Integrates with mobile device management (MDM) platforms to exchange information about mobile endpoints. |
| FCEMS_SCEP | Serves ZTNA certificates for mobile endpoints that MDM platforms manage. |