- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
08-11-2020 07:49 AM
We want to move the users to a different portal adres. How can we do this without asking all users to manualy adjust the portal adres?
i've tried changing the reg key set at installation time, but this didn't work (tried rebooting and refresh connection).
After the reboot it even changed back!
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup
My assumption would be:
1. change regkey adres
2. delete the appdata folder
C:\Users\%username%\AppData\Local\Palo Alto Networks\GlobalProtect
3. reboot ?
11-25-2020 02:39 AM
Any updates on this? We have exactly the same issue. It works after i repair the installation manually on the computer, but that just isn't doable for all my users.
01-05-2021 11:49 PM
the sequence should be
net stop panGPS
[HKEY_CURRENT_USER\Software\Palo Alto Networks\GlobalProtect\Settings] "LastUrl"="your-portal-here"
remove old portal
[-HKEY_CURRENT_USER\Software\Palo Alto Networks\GlobalProtect\Settings\old-portal]
net start panGPS
But this can't be executed. a normal user can't stop/start pangps and a system user doesn't know the users regkey.
03-24-2021 11:11 PM
I've written a powershell script to do this. maybe this will help others.
It first stops pangs, changes and removes the old portals while iterating over the registery for all users and then starts it again.
Run it with elevated privilages.
#check for input
if (!$args[0] )
{ Write-Host "Invalid argument. usage: change-portal.ps1 <new portal>"
exit }
#vars
$PortalAddress = $args[0]
$OldPortals = @('x.oldportal1.com', 'x2.oldportal1.com' )
#Get current portal
$pansetup = Get-ItemProperty -path "registry::HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup" -Name 'Portal'
$pansetup = $pansetup.Portal
Write-Host "Changing install portal address $pansetup to $PortalAddress"
#stop global protect
Stop-Service PanGPS
#set portal adres for new installations
Set-Itemproperty -path "registry::HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup" -Name 'Portal' -value $PortalAddress
# Regex pattern for SIDs
$PatternSID = 'S-1-5-21-\d+-\d+\-\d+\-\d+$'
# Get Username, SID, and location of ntuser.dat for all users
$ProfileList = gp 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\*' | Where-Object {$_.PSChildName -match $PatternSID} |
Select @{name="SID";expression={$_.PSChildName}},
@{name="UserHive";expression={"$($_.ProfileImagePath)\ntuser.dat"}},
@{name="Username";expression={$_.ProfileImagePath -replace '^(.*[\\\/])', ''}}
# Get all user SIDs found in HKEY_USERS (ntuder.dat files that are loaded)
$LoadedHives = gci Registry::HKEY_USERS | ? {$_.PSChildname -match $PatternSID} | Select @{name="SID";expression={$_.PSChildName}}
# Get all users that are not currently logged
$UnloadedHives = Compare-Object $ProfileList.SID $LoadedHives.SID | Select @{name="SID";expression={$_.InputObject}}, UserHive, Username
# Loop through each profile on the machine
Foreach ($item in $ProfileList) {
# Load User ntuser.dat if it's not already loaded
IF ($item.SID -in $UnloadedHives.SID) {
reg load HKU\$($Item.SID) $($Item.UserHive) | Out-Null
}
#####################################################################
# This is where you can read/modify a users portion of the registry
"{0}" -f $($item.Username) | Write-Output
Set-Itemproperty -path "registry::HKEY_USERS\$($Item.SID)\Software\Palo Alto Networks\GlobalProtect\Settings" -Name 'LastUrl' -value $PortalAddress
Foreach ($Oldportal in $Oldportals) {
Remove-Item -path "registry::HKEY_USERS\$($Item.SID)\Software\Palo Alto Networks\GlobalProtect\Settings\$OldPortal" -Recurse
}
#####################################################################
# Unload ntuser.dat
IF ($item.SID -in $UnloadedHives.SID) {
### Garbage collection and closing of ntuser.dat ###
[gc]::Collect()
reg unload HKU\$($Item.SID) | Out-Null
}
}
#start global protectc
Start-Service PanGPS
10-26-2021 10:21 PM
I came here and created an account just say Thank you @NOC-VL !! This gave me a great starting point for my script. I am not sure why anyone else is not complaining about the fact that when you change the "pansetup" key it doesnt actually change anything for users that have already logged in via GP and created a profile (under their individual "HKEY_USERS" tree!
06-17-2022 10:18 AM
This is great work. Thank you for sharing it.
08-23-2023 03:09 PM
Nice work one of my customer asked me this very question today and I told him I will try and get answer for him and he found this here and sent me the link. Great work thanks for sharing😊
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!