topic Re: Set a new GlobalProtect VPN portal to prisma for 1000+ devices in General Topics

Set a new GlobalProtect VPN portal to prisma for 1000+ devices

AJP_UK — Wed, 07 Feb 2024 14:01:13 GMT

Hi, I've been asked to roll out a new VPN portal and automatically switch users over to it in a phased approach. I don't think this is possible via Palo Alto (as it will set it for all users immediately) and Group Policy has some limitations around phased approaches so we are using SCCM. I have a script which i am testing but getting mixed results. From what I've read, all I need to do is:

Stop the PanGPS Service
Set HKEY_CURRENT_USER\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\LastUrtl to 'NewAddressHere'
Set HKEY_LOCAL-MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\Portal to 'NewAddressHere'
Restart the PanGPSService

Is this correct? Does this cover all the registry entries that need to be changed? Currently when doing this the system tray item for GP VPN connection will take a few minutes and then fail to connect. If I then manually click Connect to will connect successfully within about 10 seconds

Re: Set a new GlobalProtect VPN portal to prisma for 1000+ devices

BPry — Thu, 08 Feb 2024 22:40:58 GMT

@AJP_UK,

#################### ## Variables List ## #################### $TargetPortal = 'YourPortal' ################## ## Start Script ## ################## # Regex pattern for SIDs $PatternSID = 'S-1-5-21-\d+-\d+\-\d+\-\d+$' # Get Username, SID, and location of ntuser.dat for all users $ProfileList = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*' | Where-Object {$_.PSChildName -match $PatternSID} | Select-Object @{name="SID";expression={$_.PSChildName}}, @{name="UserHive";expression={"$($_.ProfileImagePath)\ntuser.dat"}}, @{name="Username";expression={$_.ProfileImagePath -replace '^(.*[\\\/])', ''}} # Get all user SIDs found in HKEY_USERS (ntuder.dat files that are loaded) $LoadedHives = Get-ChildItem Registry::HKEY_USERS | Where-Object {$_.PSChildname -match $PatternSID} | Select-Object @{name="SID";expression={$_.PSChildName}} # Get all users that are not currently logged $UnloadedHives = Compare-Object $ProfileList.SID $LoadedHives.SID | Select-Object @{name="SID";expression={$_.InputObject}}, UserHive, Username # Loop through each profile on the machine Foreach ($item in $ProfileList) { # Load User ntuser.dat if it's not already loaded IF ($item.SID -in $UnloadedHives.SID) { reg load HKU\$($Item.SID) $($Item.UserHive) } ##################################################################### # This is where you can read/modify a users portion of the registry # Grab the LastUrl String "{0}" -f $($item.Username) | Write-Output $ItemPath = "registry::HKEY_USERS\" + $item.SID + "\Software\Palo Alto Networks\GlobalProtect\Settings" if (Test-Path $ItemPath){ $LastUrl = Get-ItemPropertyValue $ItemPath -Name LastUrl if (-NOT ($LastUrl -eq $TargetPortal)){ New-ItemProperty -Path $ItemPath -Name LastUrl -Value $TargetPortal -PropertyType String -Force } else { Write-Host "$(item.Username) : LastUrl value matches $TargetPortal" } } ##################################################################### # Unload ntuser.dat IF ($item.SID -in $UnloadedHives.SID) { ### Garbage collection and closing of ntuser.dat ### [gc]::Collect() reg unload HKU\$($Item.SID) | Out-Null } } # Update Machine Strings # $PanSetup = "registry::HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup" $PanSettings = "registry::HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings" if (Test-Path $PanSetup){ $Portal = Get-ItemPropertyValue $PanSetup -Name Portal if (-NOT ($Portal -eq $TargetPortal)){ New-ItemProperty -Path $PanSetup -Name Portal -Value $TargetPortal -PropertyType String -Force } } if (Test-Path $PanSettings){ $LastUrl = Get-ItemPropertyValue $PanSettings -Name LastUrl if (-NOT ($LastUrl -eq $TargetPortal)){ New-ItemProperty -Path $PanSettings -Name LastUrl -Value $TargetPortal -PropertyType String -Force } }

Re: Set a new GlobalProtect VPN portal to prisma for 1000+ devices

AJP_UK — Fri, 09 Feb 2024 10:37:47 GMT

Thanks for the script, I found something similar which also sets the Portal registry and starts/stops the service but the connection doesn't always restart so I need to force a reboot with the script rollout.

Re: Set a new GlobalProtect VPN portal to prisma for 1000+ devices

AJP_UK — Fri, 09 Feb 2024 10:41:10 GMT

More info is here: https://www.reddit.com/r/paloaltonetworks/comments/1al369q/set_a_new_globalprotect_vpn_portal_to_prisma_for/?rdt=55113