Windows 10 Release Cycle and Global Protect Client

[NQ1234]

Hi All,

I'm currently working in an environment which is trying to keep up with the latest Windows 10 release cycles with their Windows as a Service model which brings out releases every 6 months.  We have found that with our AV products, our vendor  has struggled to keep pace the Microsoft's development of Windows 10 and as a result we have had some impact to our desktop users despite sensible testing.

https://docs.microsoft.com/en-us/windows/windows-10/release-information

As a result our support teams have a paranoia about any end point software.  I've looked at compatibility matrix information for Global Protect client and can only find references to Windows 10 being supported and not specific releases.  E.g. 1607, 1703, 1709 etc.  

Can anyone confirm where Palo Alto tests it's releases against the latest Microsoft OS releases?  Is there anywhere which details for each Global protect client version, which versions of Windows 10 it has been tested against?  Does anyone know if Palo Alto work with Microsoft in codevelopment to ensure that Global Protect client keeps pace with the Microsoft OS releases?

Any information would be appreciated to help build confidence in this.  

Thanks

[gwesson]

> Can anyone confirm where Palo Alto tests it's releases against the latest Microsoft OS releases?

Yes, it is tested. There are always things that can still break, but that's pretty rare.

> Is there anywhere which details for each Global protect client version, which versions of Windows 10 it has been tested against? 

No, just the main version. It's really the same thing with all operating systems. We support Android 9 for example, but don't provide all the various patch versions.

> Does anyone know if Palo Alto work with Microsoft in codevelopment to ensure that Global Protect client keeps pace with the Microsoft OS releases?

The regular releases are definitely tested, but there is always a limit of what a 3rd party like PAN (and other vendors) are able to do. If Microsoft makes a big change that isn't available to test before hand, there's no way to plan for something like that. I haven't personally seen that happen before, if that's any comfort.

For HIP data, Palo Alto Networks utilizes Opswat technology for the various components (AV, encryption, firewall version, etc.), and you can see some of the support matrix info here:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkvCAC

[Brandon_Wertz]

I think "paranoid" is correct in this instance.  The operating system is Win10, not 1703/1709/1803...These are essentially a service pack.  It's not an architectural change to the operating system is like going from Win7 to Win10.

This compatibility matrix lists what GP client versions is supported on Win10

https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalp...

[NQ1234]

Thanks for the information folks. 

It's a pity that it's not more granular however.  Since Globalprotect client releases are frequent I'd have expected the release notes or some other reference maternal to at least provide compatibility information at this level.