GlobalProtect windows negating/disabling RSA Authentication

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

GlobalProtect windows negating/disabling RSA Authentication

L4 Transporter

We use RSA's MFA Agent for Windows authentication.  When we install or update GlobalProtect, it disables the MFA Agent at Windows login until we connect at least once via the VPN.  It appears it is adding itself as an authentication provider into the Windows Login UI and I suspect it is related to these registry entries below.  Has anyone found a way to prevent this during the installation via a command line switch or some other method? It is of course of concern for us as it is a security risk not having RSA enabled.

(FYI - this has happened with multiple versions of 6.1.x - latest being 6.1.4 - and we do have connect-before-login enabled for GP)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}]
@="PanV2CredProv"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}\InprocServer32]
@="PanV2CredProv.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}]
@="PanV2CredProv"

 

Once we connect the VPN these registry entries are removed.

2 REPLIES 2

L4 Transporter

I've determined that removing this key and rebooting fixes this issue but WHY does GP add this in the first place and then subsequently remove it once you've logged in to the VPN at least once?

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{25CA8579-1BD8-469c-B9FC-6AC45A161C18}]
@="PanV2CredProv"

L4 Transporter

When GlobalProtect connects to the firewall for the first time with proper credentials, it removes the registry keys in the original post.  Anyone have any idea why it adds them and if there is a way to stop it?

  • 1013 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!