topic Re: Silent deployment of GlobalProtect without auto launch? in General Topics

Silent deployment of GlobalProtect without auto launch?

mwineke — Fri, 02 Jun 2017 17:45:45 GMT

I am deploying Global Protect agent 4.0.0-90, but it auto launches after installation.

I'd like it to be entirely silent. No auto launch.

Is there a flag I've not seen for this?

Re: Silent deployment of GlobalProtect without auto launch?

mwineke — Fri, 02 Jun 2017 22:47:41 GMT

Under macOS, I have two options. Either remove the KeepAlive and RunAtLoad keys from the ...pangpa.plist LaunchAgent (essentially disabling the auto launch, but leaving the enabled plist in place), or removing that LaunchAgent entirely.

Since it does not auto launch until login, then deployment scripting can handle that fairly easily.

Issuing two defaults commands to remove the keys, or replace the keys, is quick and seemingly painless.

As the prepopulation of the server address is actually working under macOS, this is acceptable

Not so easy on the Windows side though, as it both fails to prepopulate the server address from the registry on first launch, but it also auto launches upon successful install. 😛

Re: Silent deployment of GlobalProtect without auto launch?

mwineke — Mon, 05 Jun 2017 18:59:12 GMT

Short of input from fellow Global Protect deployment techs, I've found one way to pre-populate the portal field, though quite a bit more involved and resource intensive, it "looks" fairly straight forward:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-predefine-Global-Protect-portal-address-using-Microsoft/ta-p/149512

Anyone have any experience otherwise?

Re: Silent deployment of GlobalProtect without auto launch?

Remo — Mon, 05 Jun 2017 22:30:05 GMT

Do you need to do this on corporate computers or for external BYOD computers?
I assume this autostart is to get all the additional configurations from the portal right at the beginning ... but I understand your problem. We now simply live with this login window after installation. Because we use SSO this login is not that big an issue.

I have now read again the documentation and found something what's may be worth a try (requires the use of GP SSO on computers where you/your comany controlls the software installations):
With the msiexec insallation method try to set SSO to enabled and in addition set the option for prompting for credentials when SSO fails to false.
https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-clients/deploy-agent-settings-transparently/customizable-agent-settings/agent-behavior-options#id51e0e000-9cce-425d-a4fd-e7fe51e1c8fb

Re: Silent deployment of GlobalProtect without auto launch?

mwineke — Mon, 05 Jun 2017 20:48:02 GMT

Nope. My found solution didn't work. Still comes up blank after push install. 😛

Re: Silent deployment of GlobalProtect without auto launch?

mwineke — Mon, 05 Jun 2017 20:49:43 GMT

Will give it a try. Thanks vsys_remo. 🙂

Re: Silent deployment of GlobalProtect without auto launch?

mwineke — Mon, 05 Jun 2017 21:20:52 GMT

Still no luck. Came up blank.

<Edit: Bah! I set the use-sso to yes in the msi. I did not try using the msiexec command. Will try...>

This is for enterprise deployment to the organization owned and managed endpoints.

Our end users don't want to be notified of anything that doesn't specifically pertain to them, and they also freak out when something unusual happens (like an unknown software product demands their attention).

Typically, our deployments are entirely silent. Nothing pops up on their screens unexpectedly telling them something is going to happen, or has happened. An unknown (to them) software product popping up asking for an unknown portal address, to connect to who knows what for an unknown purpose is likely to generate many Help Desk calls.

Ideally, the software is deployed silently, and it's there waiting for them to either use it, or not. We're actually fine with the portal address not being populated, but the autolaunch is more problematic.

Re: Silent deployment of GlobalProtect without auto launch?

mwineke — Tue, 06 Jun 2017 18:31:01 GMT

Okay. I was able to pre-populate the Portal address (using the MSI editor Orca instructions I posted previously), and in combination with CANCHANGEPORTAL="no", it now pops up with the login window (which has a "Cancel" button. Yay!).

The autolaunch is still undesirable, but at least it's not asking for a portal address the user would not necessarily know, with only a "Connect" button.

Progress!

I did try pushing a reg delete for the auto launch, but that does not appear to work.

Re: Silent deployment of GlobalProtect without auto launch?

Remo — Tue, 06 Jun 2017 19:16:56 GMT

Did you try with the options I mentionned?

Re: Silent deployment of GlobalProtect without auto launch?

mwineke — Wed, 07 Jun 2017 00:26:07 GMT

Yep. Still auto launches after install.

Re: Silent deployment of GlobalProtect without auto launch?

mwineke — Thu, 08 Jun 2017 00:05:15 GMT

It does work! I had a typo in the "prompting for credentials" bit. Whew! Thanks, vsys_remo!

Re: Silent deployment of GlobalProtect without auto launch?

JerrySully — Fri, 04 Aug 2017 17:19:40 GMT

Turning off prompting for credentials when SSO fails seems really problematic to me. It is not uncommon for the default credential provider to get switched from GP back to Windows, in which case GP will just fail to bring up the VPN if prompting is turned off. I guess I can kludge a way to turn it off for installation, then turn it back on again afterward, but it would really be better if there were just an MSI property that would stop the Agent from launching on installation.

Re: Silent deployment of GlobalProtect without auto launch?

JohnUrbanek — Fri, 31 Aug 2018 14:13:39 GMT

Combination of PORTAL and CONNECTMETHOD public properties worked for me with a GlobalProtect 4.1 install.

msiexec.exe /i GlobalProtect-4.1.4.msi /quiet PORTAL="vpn.acme.com" CONNECTMETHOD="on-demand"

Installs silently, does not auto-launch/auto-connect to the defined portal after silent install. Tested against GlobalProtect 4.1.4.