topic Re: GlobalProtect Event log in General Topics

GlobalProtect Event log

acura771 — Fri, 16 Aug 2019 22:58:57 GMT

Hi, I am trying to trigger a GPO event in Windows Task Scheduler on the event when someone connects to global protect.

Does anyone know where I would find that?

Re: GlobalProtect Event log

TSilverline — Sun, 18 Aug 2019 02:25:59 GMT

I am not sure how Global Protect has anything to do with GPO. Can you please elaborate about what you are hoping to achieve?

Re: GlobalProtect Event log

acura771 — Mon, 19 Aug 2019 16:01:22 GMT

Hi, I am trying to use Windows Task Scheduler to push off an event when the computer has a successful conection to global protect.

I cannot find the event log of when global connect makes the connection.

Re: GlobalProtect Event log

Mick_Ball — Mon, 19 Aug 2019 17:55:11 GMT

I’m still not sure what you need to do but have you tried the GlobalProtect post vpn script option...

imore info here...

https://docs.paloaltonetworks.com/globalprotect/8-0/globalprotect-admin/globalprotect-clients/deploy-agent-settings-transparently/deploy-agent-settings-to-windows-clients/deploy-scripts-using-the-windows-registry

Re: GlobalProtect Event log

Brandon_Wertz — Mon, 19 Aug 2019 18:24:08 GMT

@acura771 wrote:
Hi, I am trying to use Windows Task Scheduler to push off an event when the computer has a successful conection to global protect.

I cannot find the event log of when global connect makes the connection.

Why can't you just take the "connection successful" log from the system logs from the firewall when a GP client connects?

Re: GlobalProtect Event log

acura771 — Mon, 19 Aug 2019 18:24:56 GMT

This looks like it's going down the right direction.

I have a network drive that needs to be mapped to each user once they connect to the VPN. The script is on the Domain contoller, which is why they need to be connected first.

Is there any way to push this registry edit to every machine?

Re: GlobalProtect Event log

acura771 — Mon, 19 Aug 2019 18:33:35 GMT

@Brandon_Wertz

Where is that Log, Source, and Event ID generated? This needs to be a trigger inside the task scheduler.

Re: GlobalProtect Event log

Mick_Ball — Mon, 19 Aug 2019 18:34:24 GMT

If all your devices are domain members then yes this can be done via group policy, i prefer to use gpo to copy script to local device and then run script locally...

Re: GlobalProtect Event log

acura771 — Mon, 19 Aug 2019 18:41:25 GMT

@Mick_Ball

Thank you, I believe this is what we need, but I am not wrapping my head around accomplishing this. Can you provide more detailed instructions?

Re: GlobalProtect Event log

Brandon_Wertz — Mon, 19 Aug 2019 19:45:08 GMT

@acura771 wrote:
@Brandon_Wertz
Where is that Log, Source, and Event ID generated? This needs to be a trigger inside the task scheduler.

I referenced a log from the firewall system logs. Not a log which is generated from the client PC.

Re: GlobalProtect Event log

Mick_Ball — Mon, 19 Aug 2019 20:10:01 GMT

@acura771 ... if you choose not to wrap your head around accomplishing this, then you will not be able to support it,. therefore i would not actually be helping you...

google is your friend...

1.how do i copy files via group policy.

2.how do i change registry settings via group policy.

Laters...