GlobalProtect (Palo Alto)¶

# List all subkeys under the main GlobalProtect hive
Get-ChildItem "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect" -Recurse |
    Select-Object PSChildName, PSPath

# Portal-pushed configuration
Get-ChildItem "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS" |
    Select-Object PSChildName

# Configure pre-logon connection via registry
$path = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect"

# Portal address
Set-ItemProperty -Path $path -Name "PanGPPortal" -Value "vpn.entreprise.com" -Type String

# Connection method: pre-logon
Set-ItemProperty -Path $path -Name "prelogon" -Value 1 -Type DWord

# Connect method: pre-logon then on-demand
Set-ItemProperty -Path $path -Name "connect-method" -Value "pre-logon-then-on-demand" -Type String

# Verify the current connect method
$val = Get-ItemProperty "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect" `
    -Name "connect-method" -ErrorAction SilentlyContinue
$val.'connect-method'

# Check for machine certificates usable by GlobalProtect
Get-ChildItem Cert:\LocalMachine\My |
    Where-Object { $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication" } |
    Select-Object Thumbprint, Subject, NotAfter |
    Format-Table -AutoSize

# Registry path for certificate settings
$certPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\AgentConfig"

# View current certificate profile setting
Get-ItemProperty -Path $certPath -Name "CertificateStoreLocation" -ErrorAction SilentlyContinue

# Import the portal root CA into Trusted Root store
$cert = "C:\Temp\PaloAlto-RootCA.cer"
Import-Certificate -FilePath $cert -CertStoreLocation Cert:\LocalMachine\Root

# Pin a specific client certificate by thumbprint
$gpPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\AgentConfig"
Set-ItemProperty -Path $gpPath -Name "ClientCertThumbprint" `
    -Value "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2" -Type String

# Read the portal address configured on the client
$setupPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect"
(Get-ItemProperty -Path $setupPath -Name "PanGPPortal").PanGPPortal

# List cached gateway configurations
$gwPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\PortalConfig"
Get-ItemProperty -Path $gwPath -Name "Gateways" -ErrorAction SilentlyContinue

# Force a specific gateway for all connections
$gwConfPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\PortalConfig"
Set-ItemProperty -Path $gwConfPath -Name "PreferredGateway" `
    -Value "gw-paris.entreprise.com" -Type String

# Check the installed agent version
$verPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect"
(Get-ItemProperty -Path $verPath -Name "agent-version" -ErrorAction SilentlyContinue).'agent-version'

# Read split tunnel settings from the portal configuration
$splitPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\PortalConfig"
Get-ItemProperty -Path $splitPath -Name "SplitTunnelEnabled", "SplitTunnelDomains", `
    "SplitTunnelIncludes", "SplitTunnelExcludes" -ErrorAction SilentlyContinue

# Check app-based tunnel configuration
$appPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\PortalConfig"
Get-ItemProperty -Path $appPath -Name "AppBasedVPN", "AppBasedVPNApps" -ErrorAction SilentlyContinue

# Check routes added by GlobalProtect
Get-NetRoute -InterfaceAlias "PANGP Virtual Ethernet Adapter*" |
    Select-Object DestinationPrefix, NextHop, RouteMetric |
    Format-Table -AutoSize

# Disable automatic agent upgrades
$upgradePath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect"
Set-ItemProperty -Path $upgradePath -Name "allow-auto-upgrade" -Value "no" -Type String

# Verify
(Get-ItemProperty -Path $upgradePath -Name "allow-auto-upgrade").'allow-auto-upgrade'

# Pin to a specific version — prevent upgrades beyond this version
$setupPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect"

Set-ItemProperty -Path $setupPath -Name "allow-auto-upgrade" -Value "no" -Type String
Set-ItemProperty -Path $setupPath -Name "upgrade-mode" -Value "disable" -Type String

# Confirm current installed version
$version = (Get-ItemProperty -Path $setupPath -Name "agent-version" `
    -ErrorAction SilentlyContinue).'agent-version'
Write-Output "Version verrouillee : $version"

# GPO registry preference — apply to all workstations
# Path: Computer Configuration > Preferences > Windows Settings > Registry
# Action: Update
# Hive: HKEY_LOCAL_MACHINE
# Key: SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect
# Value: allow-auto-upgrade = no (REG_SZ)
# Value: upgrade-mode = disable (REG_SZ)

# Quick diagnostic — check all critical settings
$setupPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect"
$gpsPath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS"

Write-Output "=== Configuration de base ==="
$setup = Get-ItemProperty -Path $setupPath -ErrorAction SilentlyContinue
Write-Output "Portal      : $($setup.PanGPPortal)"
Write-Output "Connect     : $($setup.'connect-method')"
Write-Output "Pre-logon   : $($setup.prelogon)"
Write-Output "Version     : $($setup.'agent-version')"

Write-Output "`n=== Etat de la connexion ==="
$status = Get-ItemProperty -Path $gpsPath -ErrorAction SilentlyContinue
Write-Output "Status      : $($status.ConnectionStatus)"
Write-Output "Gateway     : $($status.ConnectedGateway)"

# Check 1: Verify the portal certificate trust chain
$portalFQDN = "vpn.entreprise.com"
$result = Test-NetConnection -ComputerName $portalFQDN -Port 443
Write-Output "Connectivite : $($result.TcpTestSucceeded)"

# Check 2: Verify machine certificate is present and valid
$machCerts = Get-ChildItem Cert:\LocalMachine\My |
    Where-Object {
        $_.NotAfter -gt (Get-Date) -and
        $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication"
    }
Write-Output "Certificats machine valides : $($machCerts.Count)"
$machCerts | Select-Object Thumbprint, Subject, NotAfter | Format-Table -AutoSize

# Check 3: Verify root CA is in Trusted Root store
$rootCerts = Get-ChildItem Cert:\LocalMachine\Root |
    Where-Object { $_.Subject -match "PaloAlto|GlobalProtect|Entreprise" }
Write-Output "Certificats racine pertinents : $($rootCerts.Count)"

# Reset GlobalProtect client configuration
# WARNING: This removes all cached portal/gateway config
Stop-Service PanGPS -Force -ErrorAction SilentlyContinue

# Back up current configuration
reg export "HKLM\SOFTWARE\Palo Alto Networks\GlobalProtect" C:\Temp\gp-backup.reg /y

# Remove cached portal configuration
Remove-Item "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\PortalConfig" `
    -Recurse -ErrorAction SilentlyContinue
Remove-Item "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\AgentConfig" `
    -Recurse -ErrorAction SilentlyContinue

# Restart the service
Start-Service PanGPS
Write-Output "Configuration reintialisee. Le client va re-telecharger la config du portail."

# Search for connection errors in the last 100 lines
Get-Content "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log" -Tail 100 |
    Select-String -Pattern "Error|Failed|Timeout"

# Verify auto-enrollment is working on a sample machine
$certs = Get-ChildItem Cert:\LocalMachine\My |
    Where-Object {
        $_.Issuer -match "CA-Interne" -and
        $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication" -and
        $_.NotAfter -gt (Get-Date)
    }

if ($certs.Count -ge 1) {
    Write-Output "OK : $($certs.Count) certificat(s) machine valide(s) trouve(s)"
    $certs | Select-Object Thumbprint, Subject, NotAfter | Format-Table -AutoSize
} else {
    Write-Output "ERREUR : aucun certificat machine valide. Verifiez l'auto-enrollment."
}

# Script to create the registry values (run on each workstation via GPO startup script)
$basePath = "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect"

# Ensure the key exists
if (-not (Test-Path $basePath)) {
    New-Item -Path $basePath -Force | Out-Null
}

# Portal address
Set-ItemProperty -Path $basePath -Name "PanGPPortal" -Value "vpn.entreprise.com" -Type String

# Pre-logon mode
Set-ItemProperty -Path $basePath -Name "prelogon" -Value 1 -Type DWord
Set-ItemProperty -Path $basePath -Name "connect-method" -Value "pre-logon" -Type String

# Prevent users from disconnecting
Set-ItemProperty -Path $basePath -Name "allow-user-disconnect" -Value "no" -Type String

# Lock the upgrade version
Set-ItemProperty -Path $basePath -Name "allow-auto-upgrade" -Value "no" -Type String
Set-ItemProperty -Path $basePath -Name "upgrade-mode" -Value "disable" -Type String

Write-Output "GlobalProtect pre-logon configure avec succes."

# Silent install of GlobalProtect via GPO software deployment or startup script
$msiPath = "\\serveur-fichiers\Deploiement\GlobalProtect\GlobalProtect64-6.2.1.msi"
$logFile = "C:\Windows\Temp\GP-Install.log"

Start-Process msiexec.exe -ArgumentList "/i `"$msiPath`" /qn /l*v `"$logFile`" PORTAL=vpn.entreprise.com" `
    -Wait -NoNewWindow

# Verify installation
$installed = Get-ItemProperty "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect" `
    -Name "agent-version" -ErrorAction SilentlyContinue
Write-Output "Version installee : $($installed.'agent-version')"

# Post-deployment validation script (run on sample machines)
$checks = @()

# Check 1: Service running
$svc = Get-Service PanGPS -ErrorAction SilentlyContinue
$checks += [PSCustomObject]@{ Test = "Service PanGPS"; Result = $svc.Status }

# Check 2: Registry configuration
$reg = Get-ItemProperty "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\GlobalProtect" `
    -ErrorAction SilentlyContinue
$checks += [PSCustomObject]@{ Test = "Portal configure"; Result = $reg.PanGPPortal }
$checks += [PSCustomObject]@{ Test = "Pre-logon actif"; Result = $reg.prelogon }
$checks += [PSCustomObject]@{ Test = "Methode connexion"; Result = $reg.'connect-method' }

# Check 3: Machine certificate
$cert = Get-ChildItem Cert:\LocalMachine\My |
    Where-Object { $_.EnhancedKeyUsageList.FriendlyName -contains "Client Authentication" }
$checks += [PSCustomObject]@{ Test = "Certificat machine"; Result = "$(if($cert){'Present'}else{'ABSENT'})" }

# Check 4: Portal reachability
$net = Test-NetConnection -ComputerName $reg.PanGPPortal -Port 443 -WarningAction SilentlyContinue
$checks += [PSCustomObject]@{ Test = "Connectivite portail"; Result = $net.TcpTestSucceeded }

$checks | Format-Table -AutoSize