Feature Request : GlobalProtect Disable uninstall of agent from workstation

[tmcneil]

We need the ablity to disable the uninstall of the GlobalProtect agent from our corp laptops. As it is now our users can and will uninstall it.

Traps has this ablity but I cannot seem to find anywhere to secure GlobalProtect

[BPry]

@tmcneil ,

To the best of my knowledge this is not a feature within GlobalProtect. Traps does this through an uninstall password, which isn't an option with GlobalProtect. I would recommend you contact your SE to either add your vote to an existing feature request for this feature or have him create a feature request for this. 

[Mick_Ball]

Can this not be done via "Group Policy".

[BPry]

@Mick_Ball,

The fact that they have permissions to uninstall applications would lend them to being local admins. You can certaintly make it harder via file permissions and registry access settings, but they can override any of that. 

@tmcneil, you could disable the actual Windows Installer once everything is actually configured to prevent any installation or uninstallation of software across the board, however I'm guessing the users are local admins for a reason and they actually need to be able to install/remove other applications. Obviously the best course of action would be to remove their admin rights so they couldn't do this. 

[tmcneil]

I wish we could remove their admin right but…

Anyway Traps has the ability to be secured with an uninstall password. I was hoping for something like that

[Mick_Ball]

OK noted, we use a proxy.pac file to prevent web access without GProtect but if they are admin then this can also be removed.

[BPry]

@tmcneil,

So I suck at actually reading and didn't notice you had Feature Request right in the subject of the message. Feature Request need to go through your SE as nobody here can actually enter them for you. Once you've done that and they've either established an existing FE number or give you the new FE number they generated be sure to post it here so people can add their vote to it, as the feature would be rather helpful in situations like yours. 

[Remo]

@tmcneil 

When you have received the feature request ID by your SE, please post it in this topic: https://live.paloaltonetworks.com/t5/General-Topics/Feature-Request-List/m-p/209128#M61154

[adippel]

How do I find status of feature requests made via the SE? 

--Alan

[tmcneil]

Here is the number my FE got entered for me.

FR ID: 5357 - GlobalProtect Agent uninstall password