topic Always On Global Protect and file share access in General Topics

Always On Global Protect and file share access

MichaelMedwid — Fri, 07 May 2021 05:50:13 GMT

I now have GP connected automatically with a certificate pushed out via InTune. This is on a Surface Laptop running Win 10. I typically log in with face recognition. After I log on and notice that I have TCP/IP access through the GP connection and internal DNS is working - I am trying to then go to a file share. \\whatever\sys$\whichever say. I am then prompted for my credentials and a note is there "The system cannont contact a domain controller to service the authentication request." I have no thought why it can't find the DC. To work around this click "Use a different account" and enter my work email and password.This is the same email as the one associated with my face recognition. But after I login through using this "Other User" I then have access to the file share. I checked cmd/set user and that looks the same before my "Other User" login as after. Any ideas appreciated!

Re: Always On Global Protect and file share access

reaper — Fri, 07 May 2021 10:49:01 GMT

biometric logon doesn't pass along SSO credentials, it simply allows you access to the desktop, which could be an issue for GP

check out this article: Biometric Sign-In Support (paloaltonetworks.com)

Re: Always On Global Protect and file share access

MichaelMedwid — Fri, 07 May 2021 13:33:11 GMT

That was it. Thank you!

Re: Always On Global Protect and file share access

Remo — Sun, 16 May 2021 17:25:23 GMT

Hi @reaper

Actually we use SAML to explicitly enable single sign on for the users. Yes, this is not integrated functionality of global protect, but it does the job perfectly well. With this it is possible to use biometric logon (Windows Hello) and with SAML to an ADFS server or Azure AD it is possible to have single sign on there for the users. And we use this also with pre-logon (Just because in the linked article in the table it shows it works only with on-demand connections and SAML is not supported)

Re: Always On Global Protect and file share access

reaper — Sun, 16 May 2021 18:15:31 GMT

Ooh! Do you have that documented anywhere? My org's windows guys are eager to implement WH but GP is a showstopper right now.

Re: Always On Global Protect and file share access

Remo — Sun, 16 May 2021 22:27:04 GMT

@reaper not yet ... maybe this would be an idea for an article that I could create 😉

PS: With this solution it is not possible to use the global protect login option on w10 ... just in case this wasn't clear already