GlobalProtect app - How to stop PanGPS from opening PanGPA constantly?

[BeKindPleaseRewind]

So we are trying to prevent the Palo Alto agent from opening at startup. 

I believe I fixed that initially by removing its entry from"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run".

However there's a service running, "PANGps" ("C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe") that appears to continue re-lauching the process "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe" eevery time PanGPA.exe is closed, until PanGPS.exe is closed. 

Is PanGPS a service required to be running?

Is there a way to prevent PanGPS from continuing to re-launch PanGPA.exe? 

[BPry]

@BeKindPleaseRewind,

The PanGPS service needs to be running for GlobalProtect to function. You can change the service to 'Manual' and GlobalProtect will launch start the service. However, I don't recall ever seeing an instance where the service launced the executable; what version of the agent are you running? 

[BeKindPleaseRewind]

It's 4.1.2 version.

And I ran Process Monitor and watched the service keep launching the executable.

Time of Day	Process Name	PID	Operation	Path
32:57.2	PanGPS.exe	5748	Process Create	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

Then if I run "taskkill /im PanGPA.exe /f"

a second later PanGPS.exe runs the PanGPA.exe again. 

Here is a video of this happening: https://youtu.be/9fkbyZZug_k

[BeKindPleaseRewind]

When I terminate both PanGPS and PanGPA, this is the process that goes on before they both start back up.

I also have the Service disabled this entire transaction.

I found the "HKLM\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\RestartPanGPA" one particularly interesting. 

Time of Day	Process Name	PID	Operation	Path	Result	Detail
25:33.0	PanGPS.exe	15796	QueryDirectory	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Filter: PanGPS.log, 1: PanGPS.log
25:33.0	PanGPS.exe	15796	CreateFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Desired Access: Generic Write, Read Attributes, Disposition: OpenIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: None, AllocationSize: 0, OpenResult: Opened
25:33.0	PanGPS.exe	15796	QueryStandardInformationFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	AllocationSize: 434,176, EndOfFile: 430,591, NumberOfLinks: 1, DeletePending: False, Directory: False
25:33.0	PanGPS.exe	15796	QueryStandardInformationFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	AllocationSize: 434,176, EndOfFile: 430,591, NumberOfLinks: 1, DeletePending: False, Directory: False
25:33.0	PanGPS.exe	15796	WriteFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Offset: 430,591, Length: 435, Priority: Normal
25:33.0	PanGPS.exe	15796	QueryBasicInformationFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	CreationTime: 10/25/2018 8:12:34 AM, LastAccessTime: 10/25/2018 8:12:34 AM, LastWriteTime: 10/25/2018 11:22:10 AM, ChangeTime: 10/25/2018 11:22:10 AM, FileAttributes: A
25:33.0	PanGPS.exe	15796	ReadFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Offset: 0, Length: 64
25:33.0	PanGPS.exe	15796	ReadFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Offset: 0, Length: 7
25:33.0	PanGPS.exe	15796	CloseFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS
25:37.1	PanGPS.exe	15796	RegOpenKey	HKLM\Software\Palo Alto Networks\GlobalProtect\PanGPS	SUCCESS	Desired Access: Read
25:37.1	PanGPS.exe	15796	RegQueryValue	HKLM\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS\RestartPanGPA	NAME NOT FOUND	Length: 16
25:37.1	PanGPS.exe	15796	RegCloseKey	HKLM\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS	SUCCESS
25:37.3	PanGPA.exe	8516	RegSetValue	HKCU\Software\Palo Alto Networks\GlobalProtect\PanMSAgent\PanGPS	SUCCESS	Type: REG_DWORD, Length: 4, Data: 5
25:37.3	PanGPA.exe	8516	RegQueryValue	HKCU\Software\Palo Alto Networks\GlobalProtect\PanMSAgent\PanGPS	SUCCESS	Type: REG_DWORD, Length: 4, Data: 5
25:38.0	PanGPS.exe	15796	QueryDirectory	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Filter: PanGPS.log, 1: PanGPS.log
25:38.0	PanGPS.exe	15796	CreateFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Desired Access: Generic Write, Read Attributes, Disposition: OpenIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: None, AllocationSize: 0, OpenResult: Opened
25:38.0	PanGPS.exe	15796	QueryStandardInformationFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	AllocationSize: 434,176, EndOfFile: 431,026, NumberOfLinks: 1, DeletePending: False, Directory: False
25:38.0	PanGPS.exe	15796	QueryStandardInformationFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	AllocationSize: 434,176, EndOfFile: 431,026, NumberOfLinks: 1, DeletePending: False, Directory: False
25:38.0	PanGPS.exe	15796	WriteFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Offset: 431,026, Length: 862, Priority: Normal
25:38.0	PanGPS.exe	15796	QueryBasicInformationFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	CreationTime: 10/25/2018 8:12:34 AM, LastAccessTime: 10/25/2018 8:12:34 AM, LastWriteTime: 10/25/2018 11:25:33 AM, ChangeTime: 10/25/2018 11:25:33 AM, FileAttributes: A
25:38.0	PanGPS.exe	15796	ReadFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Offset: 0, Length: 64
25:38.0	PanGPS.exe	15796	ReadFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS	Offset: 0, Length: 7
25:38.0	PanGPS.exe	15796	CloseFile	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	SUCCESS

[BeKindPleaseRewind]

I renamed the REG_Binary "FailureActions" to "FailureActions_old" at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PanGPS. 

Thereafter the process is not restarted every 60 secods by services.exe any longer 

So That key is telling the service to restart, even though under PanGPS service's Recovery tab options I have it set to "Take no action" for all 3 failure options, AND I had the service disabled as well. 

[OtakarKlier]

Hello,

I guess my question would be, why have it installed if you are just going to disable it? If you want to connect to the VPN, you will need to start those services manually.

Regards,

[BeKindPleaseRewind]

Because if a user needs to VPN they should just be able to open the program from start or desktop when they wish to.

But instead, there's an annoying window that pops up from the system tray hiding the bottom-right side of my screen, and has h no option to close. That is abnormal as I compare to all the other system tray programs I have (currently running and past ones I've had). 

[OtakarKlier]

Hello,

While I do see your viewpoint, the Cisco Anyconnect agent bwhaves in a similar fashion.

Regards,

[BeKindPleaseRewind]

Yeah it's this window that pops up.

As you can see there's no place to close it, can't move it or anything. 

It's a bit obnoxious. 

That's good to know about Cisco -- but two wrong's don't make a right. 

[BeKindPleaseRewind]

Also, it appears the root cause of the Startup overriding issue is due to the way PaloAlto adds the "shortcut" to the menu.

Apparently the shortcut to GlobalProtect is really a shortcut to some exe wrapped msi installer. 

This appears to run an msi installer once I delete the auto-run entry and then re-open the shortcut. 

If the auto-run entry for PANPga.exe exists, the shortcut will open it instead of running an installer.

That is very odd and I wonder why it was designed(?) this way. 

Seems the work-around is to create a shortcut directly to PANgpa for the user.