topic Re: Global Protect PANGP Virtual Ethernet Adapter disabled after Jun21 MS Security patches. (KB5003974 suspected) in GlobalProtect Discussions

Global Protect PANGP Virtual Ethernet Adapter disabled after Jun21 MS Security patches. (KB5003974 suspected)

EndUser_Tech — Tue, 27 Jul 2021 14:57:25 GMT

Starting after Microsoft Cumulative and Security updates released in June 2021, our users have been experiencing issues where they are unable to connect to Global Protect after resuming from a reboot or sleep. The blue "connect" button is present, and our portal is selected, but clicking the button does nothing. The PANGP Virtual Ethernet Adapter is in a disabled state and cannot be enabled, even with administrative privileges. The issue is subsides when the user reboots the laptop between 3-6 times, but will re-occur sporadically after reboots or the device goes to sleep. This has been observed on multiple versions of Global Protect (5.0.7-2, 5.2.4-21, 5.2.5-84,5.2.7) and on multiple device models (surface, dell), but all on Windows 10 1909 build. We suspect that KB5003974 is the cause of these issues, but have been able to roll back that update in any of our trials. Subsequent updates, such as July 21 patches, seem to cause the issue to re-occur.

The only way we've been able to determine to permanently address the issue is to fully scrub the Global Protect app from the users' device; removing registry entries, deleting the PanGPS service, clearing the WMI Cache entries, and deleting all file paths associated with the app before running a fresh install.

Has anyone else experienced this or similar issues since applying June Cumulative/Security patches to 1909 Windows 10 systems? Is there a tool available that would allow us to completely scrub the app from users' systems without having to do the manual steps? Trying to complete these tasks in a remote work environment is exceedingly difficult.

Re: Global Protect PANGP Virtual Ethernet Adapter disabled after Jun21 MS Security patches. (KB5003974 suspected)

JordanPetrellis — Tue, 27 Jul 2021 15:28:07 GMT

Adding to further details to the above post:

Portal/Gateway authentication is via LDAP and a machine certificate
The Global Protect device traffic never hits the firewall when hitting "Connect", so it appears to be a local Global Protect client issue.

Re: Global Protect PANGP Virtual Ethernet Adapter disabled after Jun21 MS Security patches. (KB5003974 suspected)

PaloAlto18 — Tue, 27 Jul 2021 17:42:17 GMT

@JordanPetrellis

Can you explain here below please

The Global Protect device traffic never hits the firewall when hitting "Connect", so it appears to be a local Global Protect client issue.

Re: Global Protect PANGP Virtual Ethernet Adapter disabled after Jun21 MS Security patches. (KB5003974 suspected)

EndUser_Tech — Wed, 28 Jul 2021 12:44:40 GMT

The firewall shows no connection, successful or otherwise from the device having the issue. The device with the global protect application doesn't connect to the firewall at all.