Login with globalprotect before windows login

[gyrodude]

Is it not possible in some way to launch the client from the Windows login screen, create a tunnel with the users credentials, and THEN log in to Windows? Or is the only way going the machine certificate route?

[reaper]

before having logged on to windows, the OS does not permit this sort of user interaction, so only machine level vpn can be set up

[kiwi]

Hi @gyrodude ,

Are you referring to pre-logon ?

Basic GlobalProtect Configuration with Pre-logon 

Hope this helps,

-Kiwi.

[reaper]

@gyrodude  TIL this is a new feature in PAN-OS 9.0:

Pre-Logon Followed By Two-Factor and SAML Authentication

The GlobalProtect app for Windows and Mac endpoints now supports pre-logon followed by two-factor or SAML authentication for user login. After the pre-logon tunnel is established, the user can log in to the endpoint and authenticate using the configured authentication method. If authentication is successful on Windows endpoints, the pre-logon tunnel is seamlessly renamed to User tunnel and the GlobalProtect connection is established. If authentication is successful on macOS endpoints, a new tunnel is created and the GlobalProtect connection is established.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes/pan-os-9-0-release-information/fea...