topic Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation in General Topics

Feature Request : GlobalProtect Disable uninstall of agent from workstation

tmcneil — Wed, 20 Mar 2019 15:31:41 GMT

We need the ablity to disable the uninstall of the GlobalProtect agent from our corp laptops. As it is now our users can and will uninstall it.

Traps has this ablity but I cannot seem to find anywhere to secure GlobalProtect

Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation

BPry — Wed, 20 Mar 2019 15:52:13 GMT

@tmcneil ,

To the best of my knowledge this is not a feature within GlobalProtect. Traps does this through an uninstall password, which isn't an option with GlobalProtect. I would recommend you contact your SE to either add your vote to an existing feature request for this feature or have him create a feature request for this.

Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation

Mick_Ball — Wed, 20 Mar 2019 16:50:01 GMT

Can this not be done via "Group Policy".

Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation

BPry — Wed, 20 Mar 2019 17:05:27 GMT

@Mick_Ball,

The fact that they have permissions to uninstall applications would lend them to being local admins. You can certaintly make it harder via file permissions and registry access settings, but they can override any of that.

@tmcneil, you could disable the actual Windows Installer once everything is actually configured to prevent any installation or uninstallation of software across the board, however I'm guessing the users are local admins for a reason and they actually need to be able to install/remove other applications. Obviously the best course of action would be to remove their admin rights so they couldn't do this.

Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation

tmcneil — Wed, 20 Mar 2019 17:24:15 GMT

I wish we could remove their admin right but…

Anyway Traps has the ability to be secured with an uninstall password. I was hoping for something like that

Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation

Mick_Ball — Wed, 20 Mar 2019 17:27:11 GMT

OK noted, we use a proxy.pac file to prevent web access without GProtect but if they are admin then this can also be removed.

Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation

BPry — Wed, 20 Mar 2019 17:33:40 GMT

@tmcneil,

So I suck at actually reading and didn't notice you had Feature Request right in the subject of the message. Feature Request need to go through your SE as nobody here can actually enter them for you. Once you've done that and they've either established an existing FE number or give you the new FE number they generated be sure to post it here so people can add their vote to it, as the feature would be rather helpful in situations like yours.

Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation

Remo — Wed, 20 Mar 2019 18:51:21 GMT

@tmcneil

When you have received the feature request ID by your SE, please post it in this topic: https://live.paloaltonetworks.com/t5/General-Topics/Feature-Request-List/m-p/209128#M61154

Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation

adippel — Fri, 22 Nov 2019 15:01:24 GMT

How do I find status of feature requests made via the SE?

--Alan

Re: Feature Request : GlobalProtect Disable uninstall of agent from workstation

tmcneil — Fri, 22 Nov 2019 20:06:46 GMT

Here is the number my FE got entered for me.

FR ID: 5357 - GlobalProtect Agent uninstall password