FCP FortiClient EMS 7.4 key terms

The central management server that stores endpoint configurations, deploys profiles, and coordinates registration, compliance, and telemetry for FortiClient endpoints across an organization.

A named bundle of settings and licensed features that EMS pushes to endpoints, controlling antivirus, web filtering, VPN, ZTNA, and update behavior for a group of devices.

The rule that binds endpoints to a profile, typically by workgroup, domain, organizational unit, IP range, or endpoint group, determining which settings each device receives.

A logical collection of registered endpoints used to scope profiles, compliance rules, vulnerability scans, and reports to a subset of the fleet.

A shared secret configured on EMS that an endpoint must supply during first contact, preventing unauthorized devices from enrolling in the management server.

The enrollment process in which a FortiClient installation contacts EMS, presents its identity and registration key, and becomes a managed entry in the EMS database.

An on-premises EMS component that receives endpoint telemetry and relays it to FortiClient Cloud, enabling hybrid management without exposing endpoints directly to the internet.

The packaged client software, often built by EMS with embedded registration settings, that users run to install FortiClient and auto-enroll with the correct server.

The licensing step that determines which FortiClient modules, such as ZTNA, vulnerability scanning, or patch management, are available to endpoints under EMS management.

The entitlement, purchased per endpoint or as a subscription, that unlocks advanced modules like ZTNA, EMS-managed telemetry, vulnerability management, and patching.

An access model in which every request is authenticated and authorized per application rather than trusted by network location, enforced for FortiClient users through FortiGate or EMS ZTNA proxies.

A policy on the ZTNA access proxy that matches users, groups, source, and destinations to decide whether an application connection is allowed, denied, or requires authentication.

The FortiGate or EMS-hosted gateway that terminates ZTNA tunnels from FortiClient, evaluates access rules and posture, then forwards approved traffic to internal applications.

A condition evaluated before or during access that verifies endpoint state, such as OS version, antivirus status, or certificate presence, and can gate or restrict ZTNA connectivity.

A remote-access mode in which FortiClient establishes an encrypted tunnel to a FortiGate, giving the endpoint an address on the internal network for full network access.

A FortiClient capability that connects the SSL VPN tunnel on the Windows logon screen, allowing domain authentication and Group Policy processing before the user session starts.

A VPN configuration where only traffic destined for specified internal subnets traverses the tunnel, while other traffic goes directly to the internet.

A policy in EMS that checks endpoint attributes, such as antivirus running, definitions current, or disk encryption enabled, and marks devices compliant or non-compliant.

The automated response EMS applies when an endpoint fails a compliance rule, such as notifying the user, blocking network access, or triggering remediation.

The periodic re-evaluation of endpoints against assigned compliance rules, producing status changes and audit records that administrators monitor in EMS.

An EMS-initiated assessment that inspects an endpoint's installed software and OS for known weaknesses and reports findings with severity and remediation guidance.

A profile setting that defines when and how endpoints run vulnerability checks, including scan schedules and which detections are enabled.

The EMS module that identifies missing operating system and third-party application updates on endpoints and can deploy approved patches automatically or on a schedule.

The scheduled or on-demand distribution of approved software updates to selected endpoints, including reboot behavior and success reporting back to EMS.

The ongoing cycle of discovering, prioritizing, remediating, and verifying endpoint weaknesses using scan results, severity ratings, and patch status in EMS.

A threat intelligence feed that flags active exploits and critical vulnerabilities, which EMS can use to prioritize scanning and patching for affected endpoints.

A record generated by FortiClient or EMS capturing events such as scans, compliance changes, and connection attempts, used for auditing and troubleshooting.

The configuration that sends EMS and endpoint logs to an external collector such as FortiAnalyzer or a syslog server for retention, correlation, and reporting.

A built-in FortiClient utility that collects logs, configuration, and system information into a bundle for support analysis when troubleshooting endpoint issues.

The landing view in the EMS console summarizing endpoint counts, license usage, compliance status, and recent alerts to give administrators a fleet-wide health snapshot.

A deployment of two or more EMS servers sharing configuration and database state so management continues if the primary node fails.

A saved copy of the EMS configuration and endpoint data that can be restored after failure or used to migrate to a new server.

The connection between EMS and a directory service used to import users and computers, assign profiles by OU, and authenticate administrators or endpoints.

A one-time or limited-use code that lets a user self-enroll a device with EMS without knowing the shared registration key, often distributed by email.

The vendor-hosted EMS service that manages endpoints without on-premises servers, requiring endpoints or telemetry gateways to reach the cloud over the internet.

A set of URL category and rating rules applied by FortiClient to block or allow web destinations on managed endpoints, independent of gateway filtering.

A FortiClient feature that inspects and controls application traffic on the endpoint, allowing administrators to block or log specific applications by category.