topic Users disabling GP through services.msc in General Topics

Users disabling GP through services.msc

SARowe_NZ — Mon, 06 Apr 2020 23:32:39 GMT

Hi,

We run always-on VPN. Our users have found they can disable GP by going to services.msc and disabling the service, then killing GP from task manager.

Especially with everyone working from home at the moment this is quite a big deal and we need to find a way to prevent them from stopping the GP service (some kind of tamper protection similar to what Traps/XDR or other AV products have).

Does anyone have any ideas on how we can stop this behaviour?

Cheers,

Shannon

Re: Users disabling GP through services.msc

vathreya — Tue, 07 Apr 2020 00:48:36 GMT

Hi,

With 5.1 GlobalProtect App, as an admin, you can set Disable Option to Not Allow on Dynamic App Config on the firewall to prevent users from disabling GlobalProtect. Or you can also set a time limit after which GlobalProtect tries to connect back to the portal / gateway. You can find more information here: https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-user-guide/globalprotect-app-for-windows/disable-the-globalprotect-app-for-windows.html

Regards,

Varun

Re: Users disabling GP through services.msc

vathreya — Tue, 07 Apr 2020 00:49:36 GMT

We also a new GP Space and would encourage you to post there moving forward 🙂

https://live.paloaltonetworks.com/t5/GlobalProtect/ct-p/GlobalProtect

Regards,

Varun

Re: Users disabling GP through services.msc

SARowe_NZ — Tue, 07 Apr 2020 00:58:17 GMT

Thanks Varun,

"With 5.1 GlobalProtect App, as an admin, you can set Disable Option to Not Allow on Dynamic App Config on the firewall to prevent users from disabling GlobalProtect."

Will that also prevent users from stopping the actual GP service? We already have it configured to stop users from disabling it through the GP App, and that works, but they have found they can simply go into services.msc and disable the service, then kill the GP app through task manager. This effectively allows them to completely turn off GP.

The only difference there is we are currently using agent version 4.1.x not 5.1.

Re: Users disabling GP through services.msc

DanilaKh — Fri, 10 Apr 2020 01:28:38 GMT

Hello @SARowe_NZ

I do not think that there is a standard option (I did not find any at least) that would allow you to prevent users from disabling PanGPS service using the method you mentioned.

I would propose you to enable User Account Control and to use domain/local Windows Group Policy settings to disable an access to Windows administrator's tools like 'services.msc' for standard users. It is also possible to prevent IT admins to stop particular service too. Search for 'group policy prevent user to stop service' to find how to do it.

Re: Users disabling GP through services.msc

SutareMayur — Sun, 12 Apr 2020 13:20:26 GMT

@SARowe_NZ,

PA GP settings can not control the actions taken under services.msc on end system. Best way is to make restriction on the endpoints through Windows Group policy.

Hope it helps!

Mayur

Re: Users disabling GP through services.msc

SARowe_NZ — Mon, 13 Apr 2020 20:07:17 GMT

Hi,

Thanks for the replies.

I also found this article: http://michlstechblog.info/blog/windows-set-permissions-on-a-service/

This will resolve the issue but need to find a way to deploy it easily (eg via GPO). I will take a bit more detailed look at your suggestions as suspect a combination will provide the answer.

Surprised PAN don't have tamper protection enabled natively, like is available in Traps.

Thanks again,

Shannon

Re: Users disabling GP through services.msc

Shahin.A — Fri, 08 Jan 2021 18:49:34 GMT

I am very surprised too!

Tamper protection must be a basic feature for any endpoint products such as AVs and VPN clients. Remember, we are doing all this VPN connection to make sure that we have full control over internet traffic and policies. If a user can easily stop the service and GP process the goal is not achieved even if it is for a few minutes.

I do understand that if a user does not have admin rights this becomes difficult or impossible to do but again, there should be a built in function for GP service for tamper protection regardless of whether or not the end users have admin rights!