Set the supported script schedule and change-control timing to the approved window. This can be appropriate when a scheduled script changes a network parameter outside an authorized maintenance window. It does not directly address the present situation, where the required correction is parameterize or prepare approved per-device variables rather than hardcoding one route next hop.

Create a reviewed FortiManager CLI script and target the approved device group. This can be appropriate when an engineer plans to change the same NTP server on 60 gateways using manual command-line sessions. It does not directly address the present situation, where the required correction is parameterize or prepare approved per-device variables rather than hardcoding one route next hop.

Inspect per-device script execution output and the corresponding Task Monitor record. This can be appropriate when an administrator cannot explain why a CLI script partially applied to one FortiGate. It does not directly address the present situation, where the required correction is parameterize or prepare approved per-device variables rather than hardcoding one route next hop.

Identify the lock holder and coordinate release rather than forcibly breaking the lock. This can be appropriate when an administrator tries to edit a locked ADOM while another engineer is performing critical maintenance. It does not directly address the present situation, where the required correction is save, submit or discard the session according to change policy and release the lock.

Obtain the ADOM-level lock required for device creation under the relevant workspace configuration. This can be appropriate when a team wants to create a new device in an unlocked ADOM while only a different package is locked. It does not directly address the present situation, where the required correction is save, submit or discard the session according to change policy and release the lock.

Select workspace for locking control or workflow for a documented change-approval lifecycle as appropriate. This can be appropriate when an engineer claims workspace and workflow modes are identical and chooses the mode without considering approval needs. It does not directly address the present situation, where the required correction is save, submit or discard the session according to change policy and release the lock.

Device revision provenance should remain linked to the hardware identity that produced it. This mechanism instead applies when a branch firewall was replaced but historical revisions still describe the retired serial number. The current correction relies on historical snapshots are useful only when their collection timing is understood.

Revision histories reflect observed configuration collection events, not every keystroke in a CLI session. This mechanism instead applies when an engineer assumes FortiManager automatically captures a new device revision immediately after every unsaved local CLI command. The current correction relies on historical snapshots are useful only when their collection timing is understood.

Revision diffs support targeted recovery decisions rather than indiscriminate replacement. This mechanism instead applies when after a configuration outage, an engineer wants to restore one changed object but proposes replacing all FortiManager device records. The current correction relies on historical snapshots are useful only when their collection timing is understood.

Align remote management endpoint resolution with the permitted NATed address and secure service path. This can be appropriate when a management network uses split-horizon DNS, but remote FortiGates resolve the FortiManager name to an unreachable inside address. It does not directly address the present situation, where the required correction is restrict administrative access to approved management networks while preserving gateway FGFM reachability.

Assess regional control connectivity and plan supported resilience or offline operating procedures. This can be appropriate when a deployment plan uses one FortiManager for all regions but never accounts for branch latency and outage links. It does not directly address the present situation, where the required correction is restrict administrative access to approved management networks while preserving gateway FGFM reachability.

Keep FortiManager on the management plane and retain FortiGate data-plane packet forwarding. This can be appropriate when an enterprise incorrectly treats FortiManager as the live traffic gateway and routes branch user packets through its management interface. It does not directly address the present situation, where the required correction is restrict administrative access to approved management networks while preserving gateway FGFM reachability.

Each eligible test device accepts the script without command errors. That observation is relevant for the separate case a FortiManager script succeeds on one test firewall but fails on an older FortiOS version in another site. Here the decisive evidence is the failing command and its device-level response are identified for correction.

Task history records execution only during the planned period on permitted devices. That observation is relevant for the separate case a scheduled script changes a network parameter outside an authorized maintenance window. Here the decisive evidence is the failing command and its device-level response are identified for correction.

The run log contains required device diagnostic output and shows no configuration changes. That observation is relevant for the separate case a network engineer needs a controlled one-time diagnostic command across several managed firewalls without saving a permanent policy. Here the decisive evidence is the failing command and its device-level response are identified for correction.

The authorized device edit proceeds only when the appropriate resource lock is available. That observation is relevant for the separate case a managed device requires a local interface correction, but the policy package is locked by another administrator. Here the decisive evidence is the legitimate new owner obtains access without discarding needed unfinished edits.

The new device record is created only after the appropriate broader lock is acquired. That observation is relevant for the separate case a team wants to create a new device in an unlocked ADOM while only a different package is locked. Here the decisive evidence is the legitimate new owner obtains access without discarding needed unfinished edits.

A package edit is held by one owner and conflicting writes from the second operator are blocked. That observation is relevant for the separate case two administrators edit one FortiManager policy package simultaneously and overwrite each other's work. Here the decisive evidence is the legitimate new owner obtains access without discarding needed unfinished edits.

Operators can review device inventory and deploy scoped changes from one management system. That observation is relevant for the separate case a managed-services provider needs to administer dozens of customer FortiGates without signing into each firewall separately. Here the decisive evidence is a test run authenticates, completes its required operation and explicitly closes its session.

The design identifies which platform receives log data and which manages policy packages. That observation is relevant for the separate case an operations team expects FortiManager alone to store every high-volume security analytics record without planning FortiAnalyzer integration. Here the decisive evidence is a test run authenticates, completes its required operation and explicitly closes its session.

Administrators see only their assigned device groups and package objects. That observation is relevant for the separate case an organization wants the same administrative interface to manage supported FortiGate devices across multiple regions but not combine their customer policies. Here the decisive evidence is a test run authenticates, completes its required operation and explicitly closes its session.

Apply a supported system template to the correct managed devices or device group. This can be appropriate when a fleet of branch appliances requires identical DNS and NTP settings but is being configured by hand on every unit. It does not directly address the present situation, where the required correction is test FGFM management connectivity, permitted service paths and authorized device status.

Organize eligible FortiGates into appropriate device groups inside the existing authorized ADOM. This can be appropriate when an MSP needs to filter the device inventory by business unit for maintenance without creating a new ADOM. It does not directly address the present situation, where the required correction is test FGFM management connectivity, permitted service paths and authorized device status.

Use the supported FortiGate HA cluster onboarding process and confirm member identities. This can be appropriate when two new FortiGates in a high-availability pair are being registered independently with conflicting configuration records. It does not directly address the present situation, where the required correction is test FGFM management connectivity, permitted service paths and authorized device status.

Each managed serial number resolves to one expected administrative owner and device record. That observation is relevant for the separate case an organization operates hundreds of managed devices but cannot determine which FortiManager ADOM is responsible for an orphaned gateway. Here the decisive evidence is a proposed session remains pending until the authorized approval process completes.

The partner completes its authorized device task but cannot alter unrelated customer resources. That observation is relevant for the separate case a partner cannot change its delegated device because the assigned administrator profile omits device permissions. Here the decisive evidence is a proposed session remains pending until the authorized approval process completes.

Users assigned to one customer cannot read or modify another customer's ADOM records. That observation is relevant for the separate case an MSSP wants different customers' FortiGates to have separate object libraries and administrator privileges. Here the decisive evidence is a proposed session remains pending until the authorized approval process completes.

Save, submit or discard the session according to change policy and release the lock. This can be appropriate when a policy author leaves an uncommitted workspace session open during a long absence. It does not directly address the present situation, where the required correction is inspect session changes and compare the saved or submitted state before approving or discarding.

Enable workspace locking on the package or its ADOM before concurrent policy edits. This can be appropriate when two administrators edit one FortiManager policy package simultaneously and overwrite each other's work. It does not directly address the present situation, where the required correction is inspect session changes and compare the saved or submitted state before approving or discarding.

Identify the lock holder and coordinate release rather than forcibly breaking the lock. This can be appropriate when an administrator tries to edit a locked ADOM while another engineer is performing critical maintenance. It does not directly address the present situation, where the required correction is inspect session changes and compare the saved or submitted state before approving or discarding.

FortiManager manages FortiGate HA cluster metadata and members as a coordinated security device. This mechanism instead applies when two new FortiGates in a high-availability pair are being registered independently with conflicting configuration records. The current correction relies on cluster-aware management tracks both the logical HA cluster and individual member identities.

Model device correlation depends on accurate unique device identifiers and deployment metadata. This mechanism instead applies when an offline branch uses a model device entry, but two appliances share a reused blueprint identifier in a batch import. The current correction relies on cluster-aware management tracks both the logical HA cluster and individual member identities.

FortiManager device groups simplify inventory organization within an administrative domain. This mechanism instead applies when an MSP needs to filter the device inventory by business unit for maintenance without creating a new ADOM. The current correction relies on cluster-aware management tracks both the logical HA cluster and individual member identities.