CITRIX
CITRIX PROVISIONING CAUSES BLUESCREEN
ACTUAL KNOWN AND CRITICAL ISSUES
- CITRIX PROVISIONING CAUSES BLUESCREEN - Please see the solution below
In cooperation with the Citrix team, we have found out the reason for the frequent crashes and so-called BlueScreens.
To help you solve this problem until the integration in the new version, we will show you a workaround below, which will
help you to use the environment as usual without taking a security risk.
Following Steps has to be done:
The issue is due to device control, new to 4.0. Device control should be disabled when installing on Citrix Golden image.
If you install a version 4.0 or 4.1 to a golden image you must use the vdi switch
Collector Install
• Install Collector
• Make sure it is running in the console and green
• Make sure the services is running fine with Automatic setting
Prepare Solution
• If all is good
• Stop the collector
• Open cmd as Admin
Stop Collector
• Run the following Command: "C:\Program Files\Fortinet\FortiEDR\FortiEDRCollectorService.exe" --stop
• You may be prompted for the registration password which can be found in the Management Console
• In the Console
• Click Administration
• Click Tools
• Click Display < This will show your registration password
Edit CollectorBootstrap.json
• After the Services stops run the following command: notepad.exe
• In Notepad browse to the following directory: C:\ProgramData\FortiEDR\Config\Collector\CollectorBootstrap.jsn
• Edit the CollectorBootstrap.jsn file
• Search for the following entry “DisableDeviceControl”
• Set “DisableDeviceControl” to true
• Click Save
Finishing Solution
• Run the following Command in the Command Prompt:
• FortiEDRCollectorService.exe --stop --clean
• Note: The —clean remove the agentId from bootstrap
• Shutdown the machine
• Take a snaphot your procedure
• Push out images
Anytime you start the image again you will need to do this process again FortiEDRCollectorService.exe --stop --clean
>The —clean remove the agentId from bootstrap<
The golden image once configured is normally shutdown.
- every time you boot the golden image this process need to be repeated.
Anytime you start the image again:
- Open command prompt as Admin
- Run this command:
- FortiEDRCollectorService.exe --stop --clean
- Shutdown the machine
- Take a snaphot your procedure
- Push out images