GlobalProtect windows negating/disabling RSA Authentication

[TonyDeHart]

We use RSA's MFA Agent for Windows authentication.  When we install or update GlobalProtect, it disables the MFA Agent at Windows login until we connect at least once via the VPN.  It appears it is adding itself as an authentication provider into the Windows Login UI and I suspect it is related to these registry entries below.  Has anyone found a way to prevent this during the installation via a command line switch or some other method? It is of course of concern for us as it is a security risk not having RSA enabled.

(FYI - this has happened with multiple versions of 6.1.x - latest being 6.1.4 - and we do have connect-before-login enabled for GP)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}]
@="PanV2CredProv"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}\InprocServer32]
@="PanV2CredProv.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}]
@="PanV2CredProv"

Once we connect the VPN these registry entries are removed.

[TonyDeHart]

I've determined that removing this key and rebooting fixes this issue but WHY does GP add this in the first place and then subsequently remove it once you've logged in to the VPN at least once?

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}]
@="PanV2CredProv"

[TonyDeHart]

When GlobalProtect connects to the firewall for the first time with proper credentials, it removes the registry keys in the original post.  Anyone have any idea why it adds them and if there is a way to stop it?