topic Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account in General Topics

Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Wed, 09 Aug 2017 08:41:44 GMT

Hello everybody,

recently I am facing a strange Problem with Global Protect.

If I log into a Windows 7 Machine (64-bit) with an Administrator Account and enter Credentials of a NON-Administrative Account in Global Protect everything works just fine.

But if I log into the Machine with a NON-Administrative Account and try to connect with a NON-Administrative User, Global Protect won't establish the connection.

I tried to compare the logs between the Admin and NON-Admin Account, I couldn't find any simularities at all to be honest. The logs seem totally different.

Any help in this matter would be highly appriciated!

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

Mick_Ball — Wed, 09 Aug 2017 09:58:28 GMT

whilst logged in as non Admin, can you browse to the portal via https? if so, are you able to authenticate.

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Wed, 09 Aug 2017 10:27:18 GMT

I can not reach the Portal via Web Browser. "Can't reach this address".

I can ping it.

Another Computer in the same Network is able to Connect via Global Protect.

Edit: If I try to reach the Website via https it asks me to select a Certificate (there is only one listed) once I press "OK" it opens up the Portal via the Admin Account but not with the normal User.

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

Mick_Ball — Wed, 09 Aug 2017 10:36:27 GMT

are you seeing anything on the PA logs (System)

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Wed, 09 Aug 2017 11:32:06 GMT

Just checked it.

There are no Logs listed regarding Global Protect.

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

Mick_Ball — Wed, 09 Aug 2017 11:35:25 GMT

can i assume you can see the system log for the successful administrator connection?

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Wed, 09 Aug 2017 11:41:31 GMT

I am sorry, yes I can.

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

Mick_Ball — Wed, 09 Aug 2017 11:49:02 GMT

what authentication method are you using?

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Wed, 09 Aug 2017 11:52:13 GMT

We have LDAP enabled.

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

Mick_Ball — Wed, 09 Aug 2017 12:25:23 GMT

ok probably cant help any further but perhaps you should wireshark the device to see if the connection attempt is being replied to.

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

Remo — Wed, 09 Aug 2017 13:05:26 GMT

Do you only use LDAP for the authentication or may be also client/user certificates?

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

jdprovine — Wed, 09 Aug 2017 13:22:05 GMT

@husetech

Have you tried using the troubleshooting tools on the gp client? You can try doing a packet capture using the PA packet capture tools

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Thu, 10 Aug 2017 06:38:10 GMT

@Remo

In the configuration of GP there is only a LDAP Authentification displayed. Allthough you get a popup to accept a certificate from the PA on first time connect.

@jdprovine

I've never used the Packet Capturing. When I activate Packet Capture it tells me that the systems performance can degrade drastically. I don't think I want to do this. If I would use a Filter I am not sure what to fill in where to capture only traffic from that Windows 7 Machine.

Edit: When I try to connect to the Portal via HTTPS, first it asks me to accept the certificate then it says the Web Address can't be reached " ERR_SSL_CLIENT_AUTH_CERT_NO_PRIVATE_KEY". With the Windows Administrator Account this works without problems.

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Thu, 10 Aug 2017 07:44:34 GMT

Now I am pretty sure that the Problem comes from the Windows Installation / Updates.

We installed two Computers with a new image, in which all the Windows Updates until 08/17 are included.

This installation is causing the troubles, every other installation in which we didn't use this updated Image works just fine.

So are there any Updates we have to remove in order to make GP work with User rights?

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

Remo — Thu, 10 Aug 2017 07:50:28 GMT

@husetech

Because of the error you described when you connect with a non-admin user to the website, I think you have cert-authentication configured, even if it is accidentially.

Could you share a screenshot of your portal configuration?

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Thu, 10 Aug 2017 08:07:59 GMT

@Remo

I hope this helps:

I hope you saw Message #14 in which I suspect the Windows Updates to be the problem.

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

Remo — Thu, 10 Aug 2017 09:21:32 GMT

Hi @husetech

Yes, I read your post about the suggestion with the windows updates. I mean if this is the only difference between the clients then go ahead and remove the updates. Might be worth a try.

But I still can't get the "missing private key" error out of my mind and what this exactly has to do with the connection problem. Are there differences in the certificate store between the admin and non-admin users?

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

Remo — Thu, 10 Aug 2017 09:25:55 GMT

... and about the packet capture: If you set the source to the IP from where your client is connecting and the destination to your portal IP, then you, in most cases, don't have to worry about performance problems. Simply set the filters as exact as possible, this wil also help you seeing the data you want to see and you then don't have to search in a big capture for that one connection

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Thu, 10 Aug 2017 09:36:48 GMT

Yes at some point I will probably compare the Updates installed on the Machine with the ones from our WSUS.

There is one difference I noticed when trying to install the certificate via Web Browser, it gives me this Error:

Translation: There was an Error trying to open the Organization trust store.

Installing it with the Admin Account works.

Furthermore if I try to replace the DNS Name with the IP Adress in GP it gives me this:

Translation: Basically saying there is a problem with the security certificate, that's why the identity can't be checked.

But I think that is because it is not the DNS Name which the Certificate refers to.

Re: Global Protect 4.0.2 -19 only connects with Windows Administrator Account

husetech — Fri, 11 Aug 2017 12:10:52 GMT

So I deinstalled the Updates which were different from the working Machine we have here.

After every Update-Deinstallation I tested GP to see which Update cause the Problem, but none of them seemed to be the cause..

Then I logged into another User Account which has never been logged in on this Machine. Suddenly GP worked just fine, it connected and asked for credentials.

It looks like one ore more deinstalled Windows Update caused the problem, not only that, it also changed the configuration of the Users profile. So once the User profile, which got changed by the bad Update, got written back to the server you have a problem.

I probably delte the User Profile and create a completely new one.

Updates I deinstalled:

KB2393802

KB2525835

KB2534111

KB2643719

KB2656356

KB2706045

KB2716513

KB2719033

KB2758857

KB2765809

KB3018238

KB3031432

KB3068457

KB3075220

KB3076895

KB3124275

KB3133043

KB3148851

KB3153731

KB3169658

KB3177723

KB3182203

KB3203884

KB4012864

One or more of these Updates is probably a Internet / Certificate Update which caused the problem.