Set a new GlobalProtect VPN portal to prisma for 1000+ devices

[AJP_UK]

Hi, I've been asked to roll out a new VPN portal and automatically switch users over to it in a phased approach. I don't think this is possible via Palo Alto (as it will set it for all users immediately) and Group Policy has some limitations around phased approaches so we are using SCCM. I have a script which i am testing but getting mixed results. From what I've read, all I need to do is:

1. Stop the PanGPS Service
2. Set HKEY_CURRENT_USER\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\LastUrtl to 'NewAddressHere'
3. Set HKEY_LOCAL-MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\Portal to 'NewAddressHere'
4. Restart the PanGPSService

Is this correct? Does this cover all the registry entries that need to be changed? Currently when doing this the system tray item for GP VPN connection will take a few minutes and then fail to connect. If I then manually click Connect to will connect successfully within about 10 seconds

[BPry]

@AJP_UK,

####################
## Variables List ##
####################
$TargetPortal = 'YourPortal'
##################
## Start Script ##
##################
# Regex pattern for SIDs
$PatternSID = 'S-1-5-21-\d+-\d+\-\d+\-\d+$'
 
# Get Username, SID, and location of ntuser.dat for all users
$ProfileList = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*' | Where-Object {$_.PSChildName -match $PatternSID} | 
    Select-Object  @{name="SID";expression={$_.PSChildName}}, 
            @{name="UserHive";expression={"$($_.ProfileImagePath)\ntuser.dat"}}, 
            @{name="Username";expression={$_.ProfileImagePath -replace '^(.*[\\\/])', ''}}
 
# Get all user SIDs found in HKEY_USERS (ntuder.dat files that are loaded)
$LoadedHives = Get-ChildItem Registry::HKEY_USERS | Where-Object {$_.PSChildname -match $PatternSID} | Select-Object @{name="SID";expression={$_.PSChildName}}
 
# Get all users that are not currently logged
$UnloadedHives = Compare-Object $ProfileList.SID $LoadedHives.SID | Select-Object @{name="SID";expression={$_.InputObject}}, UserHive, Username
 
# Loop through each profile on the machine
Foreach ($item in $ProfileList) {
    # Load User ntuser.dat if it's not already loaded
    IF ($item.SID -in $UnloadedHives.SID) {
        reg load HKU\$($Item.SID) $($Item.UserHive)
    }
    #####################################################################
    # This is where you can read/modify a users portion of the registry 
    # Grab the LastUrl String
    "{0}" -f $($item.Username) | Write-Output 
    $ItemPath = "registry::HKEY_USERS\" + $item.SID + "\Software\Palo Alto Networks\GlobalProtect\Settings"
    if (Test-Path $ItemPath){
        $LastUrl = Get-ItemPropertyValue $ItemPath -Name LastUrl 
        if (-NOT ($LastUrl -eq $TargetPortal)){
            New-ItemProperty -Path $ItemPath -Name LastUrl -Value $TargetPortal -PropertyType String -Force 
        }
        else {
            Write-Host "$(item.Username) : LastUrl value matches $TargetPortal"
        }
    }
    #####################################################################
 
    # Unload ntuser.dat        
    IF ($item.SID -in $UnloadedHives.SID) {
        ### Garbage collection and closing of ntuser.dat ###
        [gc]::Collect()
        reg unload HKU\$($Item.SID) | Out-Null
    }
}

# Update Machine Strings #
$PanSetup = "registry::HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup"
$PanSettings = "registry::HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings"
if (Test-Path $PanSetup){
    $Portal = Get-ItemPropertyValue $PanSetup -Name Portal
    if (-NOT ($Portal -eq $TargetPortal)){
        New-ItemProperty -Path $PanSetup -Name Portal -Value $TargetPortal -PropertyType String -Force
    }
} 
if (Test-Path $PanSettings){
    $LastUrl = Get-ItemPropertyValue $PanSettings -Name LastUrl
    if (-NOT ($LastUrl -eq $TargetPortal)){
        New-ItemProperty -Path $PanSettings -Name LastUrl -Value $TargetPortal -PropertyType String -Force
    }
}

[AJP_UK]

Thanks for the script, I found something similar which also sets the Portal registry and starts/stops the service but the connection doesn't always restart so I need to force a reboot with the script rollout.

[AJP_UK]

More info is here: https://www.reddit.com/r/paloaltonetworks/comments/1al369q/set_a_new_globalprotect_vpn_portal_to_pri...