topic Re: Global Protect PreLogon during Windows Autopilot with Intune in GlobalProtect Discussions

Global Protect PreLogon during Windows Autopilot with Intune

khaldeman — Fri, 22 Apr 2022 14:57:18 GMT

Hey folks,

I'm trying to get pre-logon working during the Windows autopilot process so that I can just hand out laptops and have people take them home to get configured. During the autopilot process I am deploying GlobalProtect during the device setup with a command line like this:

/quiet PORTAL="devicevpn.mydom.com" ShowPrelogonButton="yes" CONNECTMETHOD=”pre-logon" PRELOGON="1"

I'm also issuing a device cert through our SCEP portal in Azure during this device setup process.

I have also tried running a PowerShell script at this time to enable plap, but it has no effect on the outcome.

Once device setup completes, it prompts the user to login so that it can finish the "User Setup" process.

In the Network sign-in area on login, you can see the GlobalProtect Status is "NotPrelogon", even though this is clearly a logon screen.

I've been working on this for over a month now, and I can't get this working. I'm seriously thinking about doing a windows VPN...

Has anyone gotten this working? I've started tickets with support, but it's so hard to communicate...

The certificates seem to work once a user has successfully logged in one time, but that doesn't help since this is supposed to be prelogon. The users will be at home, with no access to Active Directory without VPN.

Thanks,

Kevin

Re: Global Protect PreLogon during Windows Autopilot with Intune

Garrett_Heidorn — Sat, 23 Apr 2022 02:42:20 GMT

The script that I have seen is: /quiet /norestart PORTAL=gp.site.com CONNECTMETHOD=pre-logon USESSO=yes

Re: Global Protect PreLogon during Windows Autopilot with Intune

J.Hernandez351244 — Tue, 22 Apr 2025 15:10:31 GMT

Hi, i make two files, (cmd and ps1)

file cmd

%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "InstallGP.ps1"

File installGP.ps1

$msiPath = "GlobalProtect64-6.3.2.msi"

$arguments = "/i `"$msiPath`" /q PORTAL=XXX.VpnName.com CONNECTMETHOD=pre-logon PRELOGON=1"

Start-Process -FilePath "msiexec.exe" -ArgumentList $arguments -Wait

# Registrar GlobalProtect como proveedor de credenciales PLAP

Start-Process -FilePath "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -ArgumentList "-registerplap" -Wait

# use REGEDIT (HKEY_LOCAL_MACHINE, delete *)

New-Item -Path "H*K*L*M*:\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL" -Force

Set-ItemProperty -Path "H*K*L*M*:\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL" -Name "Name VPN" -Value "XXX.VpnName.com"

Start-Sleep -Seconds 10

----------------------

Then, use IntuneWin and package both files together with the GlobalProtect installer.

Regards!!