When FortiClient is installed on a Windows Server, the default behavior for real-time protection control is:

Real-time protection is disabled:By default, FortiClient does not enable real-time protection on server installations to avoid potential performance impacts and because servers typically have different security requirements compared to client endpoints.

Thus, real-time protection is disabled by default on Windows Server installations.

References

FortiClient EMS 7.2 Study Guide, Real-time Protection Section

Fortinet Documentation on FortiClient Default Settings for Server Installations

Understanding the Automation Process:

In the Security Fabric, automation processes can include actions such as quarantining an endpoint after an IOC (Indicator of Compromise) detection.

Evaluating Responsibilities:

FortiClient EMS plays a crucial role in endpoint management and can send notifications to quarantine endpoints.

Conclusion:

The correct security fabric component that sends a notification to quarantine an endpoint after IOC detection is FortiClient EMS.

References:

FortiClient EMS and automation process documentation from the study guides.