Does the GlobalProtect Credential Provider CLSID change between versions?

[K.Tanabe043058]

Hi all,

We are considering using the Windows GPO “Assign a default credential provider” so that GlobalProtect is selected by default even on the “Other user” sign-in screen.

It looks like we need to specify the CLSID (GUID) of the GlobalProtect Credential Provider in the GPO.

I would like to confirm:

1. Is the GlobalProtect Credential Provider CLSID fixed across all GlobalProtect versions?

2. Can the CLSID change after a GlobalProtect upgrade?

3. If it can change, when or under what circumstances would it change?

4. We could not find any clear information about this in the release notes or official documentation. In that case, is the recommended approach to check the CLSID on the endpoint before and after each upgrade?

The CLSID can be checked under:

`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers`

Any information or experience would be appreciated.

Thanks!

Prisma Access 

GlobalProtect 

[maggie33west]

I believe the safest approach is to treat the GlobalProtect Credential Provider CLSID as an implementation detail rather than something guaranteed to remain unchanged across versions. Palo Alto’s documentation specifically instructs administrators to obtain the provider GUID from the endpoint registry when configuring the Windows “Assign a default credential provider” policy.