topic GlobalProtect windows negating/disabling RSA Authentication in General Topics

GlobalProtect windows negating/disabling RSA Authentication

TonyDeHart — Wed, 03 Apr 2024 16:56:22 GMT

We use RSA's MFA Agent for Windows authentication. When we install or update GlobalProtect, it disables the MFA Agent at Windows login until we connect at least once via the VPN. It appears it is adding itself as an authentication provider into the Windows Login UI and I suspect it is related to these registry entries below. Has anyone found a way to prevent this during the installation via a command line switch or some other method? It is of course of concern for us as it is a security risk not having RSA enabled.

(FYI - this has happened with multiple versions of 6.1.x - latest being 6.1.4 - and we do have connect-before-login enabled for GP)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}]
@="PanV2CredProv"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}\InprocServer32]
@="PanV2CredProv.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}]
@="PanV2CredProv"

Once we connect the VPN these registry entries are removed.

Re: GlobalProtect windows negating/disabling RSA Authentication

TonyDeHart — Wed, 03 Apr 2024 18:10:37 GMT

I've determined that removing this key and rebooting fixes this issue but WHY does GP add this in the first place and then subsequently remove it once you've logged in to the VPN at least once?

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}]
@="PanV2CredProv"

Re: GlobalProtect windows negating/disabling RSA Authentication

TonyDeHart — Tue, 09 Apr 2024 12:00:12 GMT

When GlobalProtect connects to the firewall for the first time with proper credentials, it removes the registry keys in the original post. Anyone have any idea why it adds them and if there is a way to stop it?