FortiClient 5.6.6 without EMS limitations?

[tanr]

Hi All,

Some questions regarding running FortiClient 5.6.6 with FortiGates 5.6.5, but without EMS, that I haven't been able to fully answer scanning through the docs.  Would also appreciate hearing if this will still work in 6.0.

We'll be moving our FortiGates to 5.6.5 (from 5.4.9) next week after which I'm planning to require FortiClient for a small subset of our Windows 10 users (less than 7) and one Mac user that are not currently allowed to connect to the office network by VPN.  We don't have EMS, nor are we using AD.

Questions:

[ol]

It looks like in both 5.6 and 6.0 I can still, without EMS, configure basic FortiClient Security Profiles for the endpoint users, requiring that they have current (third party) AV, current patches, use a specific web filter, etc. and can assign these profiles based on device groups, user groups, or users.  Correct?

Can I quarantine a FortiClient user from the FortiGate (or FortiAnalyzer?), without needing EMS?

Some of these are BYOD laptops that will be going onto other companies' networks.[ol]

Anything special I need to do to make their FortiClient continue working when it doesn't have access to our network?

Is it possible to have the FortiClient Warn instead of Block when it is on other networks (not our company network)?[/ol]

In 5.4.x the FortiClient Security Profile shown on the FortiGate has an Auto-Update option.  The 5.6.x documentation (http://help.fortinet.com/fclient/olh/5-6-6/FortiClient-5.6-Admin/300_Get%20started/0605_FG%20profile...) implies that this is no longer an option and that the endpoint must update their FortiClient version by hand.  Is this correct?[/ol]

Thanks for any pointers on this, or any other advice about using FortiClient.

[tanr]

Related question:  Will I be shooting myself in the foot trying to do this without EMS?