GlobalProtect Event log

[acura771]

Hi, I am trying to trigger a GPO event in Windows Task Scheduler on the event when someone connects to global protect.

Does anyone know where I would find that?

[TSilverline]

I am not sure how Global Protect has anything to do with GPO.  Can you please elaborate about what you are hoping to achieve?

[acura771]

Hi, I am trying to use Windows Task Scheduler to push off an event when the computer has a successful conection to global protect. 

I cannot find the event log of when global connect makes the connection.

[MickBall · Accepted solution]

I’m still not sure what you need to do but have you tried the GlobalProtect post vpn script option...

imore info here...

https://docs.paloaltonetworks.com/globalprotect/8-0/globalprotect-admin/globalprotect-clients/deploy...

[Brandon_Wertz]

---

@acura771 wrote:

Hi, I am trying to use Windows Task Scheduler to push off an event when the computer has a successful conection to global protect. 

I cannot find the event log of when global connect makes the connection.

---

Why can't you just take the "connection successful" log from the system logs from the firewall when a GP client connects?

[acura771]

This looks like it's going down the right direction. 

I have a network drive that needs to be mapped to each user once they connect to the VPN. The script is on the Domain contoller, which is why they need to be connected first. 

Is there any way to push this registry edit to every machine?

[acura771]

@Brandon_Wertz 

Where is that Log, Source, and Event ID generated? This needs to be a trigger inside the task scheduler.

[MickBall]

If all your devices are domain members then yes this can be done via group policy, i prefer to use gpo to copy script to local device and then run script locally...

[acura771]

@MickBall 

Thank you, I believe this is what we need, but I am not wrapping my head around accomplishing this. Can you provide more detailed instructions?

[Brandon_Wertz]

---

@acura771 wrote:

@Brandon_Wertz 

Where is that Log, Source, and Event ID generated? This needs to be a trigger inside the task scheduler.

---

I referenced a log from the firewall system logs.  Not a log which is generated from the client PC.