Service Accounts and GP

RobertShawver — Wed, 02 Apr 2025 16:30:26 GMT

Situation is this, a normal user logs into a PC and GP auto connects. User logs out and back in as a service account and GP does not auto login. Any ideas?

Re: Service Accounts and GP

kiwi — Thu, 03 Apr 2025 11:43:04 GMT

Hi @RobertShawver ,

It sounds like a GP authentication issue related to user profile persistence and credential storage.
Here are some scenarios where I've seen similar behavior:

If GlobalProtect is configured to save credentials, it might still be holding the first user's credentials and failing to prompt for the new one. Check in GlobalProtect Settings and see if credentials are saved. Try manually disconnecting GP before switching users.

GlobalProtect runs in the user context, meaning it may not automatically start for the second user if the first user’s session isn’t fully logged out. Ensure the first user is fully logged out and not just switched. Try using gpupdate /force to refresh policies after switching.

Some service accounts have restricted permissions, which might prevent GlobalProtect from launching. Ensure the service account has the necessary logon rights.

If GP is set to "User-Logon (Always-On)", it should reconnect automatically. However, if it is set to "Pre-Logon", it might not automatically reauthenticate after switching users. In the Portal configuration, check the "Connect Method", you may need to adjust authentication settings to allow re-login.

If GP is using Windows Credential Provider or Single Sign-On (SSO), it might not recognize the second login. Try disabling and re-enabling the GP client after logging in with the service account. If using SSO, check if the service account credentials are properly stored in the system.

If Fast User Switching is enabled, the first user session might still be active, preventing GP from correctly switching users. Disable Fast User Switching could fix this.

Does manually disconnecting and reconnecting GP work when logged in as the service account?

If GP doesn’t connect automatically, does manually launching it and clicking "Connect" work?

Is the service account allowed to access GlobalProtect according to the authentication policy?

Also check if there are any error messages in the GlobalProtect logs (PanGPS.log).

Hope this helps,

-Kim.

topic Service Accounts and GP in GlobalProtect Discussions

Service Accounts and GP

Re: Service Accounts and GP