Configuring GlobalProtect Pre-Logon on Windows 10: A Step-by-Step Guide

=====================================================================================

This article provides instructions on setting up GlobalProtect pre-logon functionality for users working within the corporate network or remotely from home/office using a Windows 10 machine. The goal is to ensure that Group Policy (GP) settings, such as drive mapping and other necessary configurations, are applied automatically upon user login without requiring manual intervention.

Prerequisites

------------

1. Ensure you have administrative privileges on your local Windows 10 machine.

2. Install the GlobalProtect client software from the official Palo Alto Networks website if not already done so.

3. Verify that you can connect to the corporate network using a web browser or other means before proceeding with this setup.

Step-by-Step Instructions

----------------------

### Step 1: Download and Extract the Required Scripts

Download both `globalprotect-pre-logon.sh` (for Linux-based systems) and/or `gpclient.psc1` from 'this repository'(https://github.com/PaloAltoNetworks/GlobalProtect-PSC/tree/master/windows). Ensure you download the correct file based on your operating system.

Extract the downloaded zip/tar.gz archives to a suitable location, such as `C:\Program Files\globalprotect-pre-logon` or equivalent depending on your OS and preferences. Make sure that both files (`gpclient.psc1`) are present in this directory after extraction.

### Step 2: Create an Autostart Entry for GlobalProtect

To ensure the GlobalVPN client starts automatically upon system startup:

1. Press `Win + R` to open Run.

2. Type `regedit` and press Enter to launch Registry Editor (if prompted, click Yes).

3. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\GlobalProtect`.

4. If the `Client' key does not exist, right-click on 'Palo Alto GlobalProtect Client', then select New > Key.

5. Right-click on the newly created 'Client' key and choose New > DWORD (32-bit) Value.

6. Name this new value as `AutoStart`, double-click it to modify its value data:

- Set the value data to 1 for enabled or 0 for disabled

7. Restart your machine to apply changes.

### Step Specify GlobalProtect Server URL

To specify the GlobalProtect server URL (portal or gateway) and optional arguments:

1. Open PowerShell as an administrator.

2. Type `gpclient --help` to view available options, then enter:

```

gpclient -s '-clientos Windows' 'optionalarguments'

```

Example Use Case

-------------

Assuming your GlobalProtect server URL is `vpn.example.com`, you would use the following command:

```bash

gpclient -s https://vpn.example.com/portal?autoconnect=true - clientos Windows

```

This will launch a GTK WebKit2 WebView window alongside your terminal where users can enter their credentials and complete any additional 2-factor authentication (2FA) requests if required.

Troubleshooting Tips

---------------

1. If you encounter issues connecting to the GlobalProtect server, verify that:

- Your network connection is stable.

- The correct URL has been entered in `gpclient`.

- Necessary ports are open on your firewalls (default: 443/8443).

2. Ensure all necessary packages or software components required by GlobalProtect client have been installed correctly.

-------

By following these steps, you should now be able to configure pre-logon functionality for the Palo Alto Networks GlobalProtect VPN client on Windows 10 machines within your organization's network infrastructure. This setup will provide a seamless user experience upon login while maintaining robust security measures through Group Policy enforcement and automatic connection establishment even before users are prompted with their credentials.

Remember that specific details may vary depending on your particular environment configuration; always consult relevant documentation or support resources if you encounter any difficulties during implementation.

Globalprotect pre-logon windows 10