Global Protect issues on few Win10 machines

[T_Wojtasinski]

Hi Guys, already have raised support ticket but no reply for few days, so trying to get some info here. I have seen couple of threads but not sure they are related to issue we have with these few Win10 laptops. We have Palo VM on 10.0.6 OS and GP is 5.2.10-6 .

We have few users having problem  with GP. From what we can see, is affecting only Win10 machines. From what we can see in logs on Palo, these clients successfully login and authenticating and after 3-5 seconds they're disconnecting. Palo not reporting any issue - from logs it looks like user login off.

Our ITSD tried reinstall GP client, update drivers but it did not work(at least that what they have claimed as in Network we dont have access to users machines) - only "clean" Win10 machine rebuild solving issue.

Below logs from one of the  "affected" Win10 machine :

LogonUI.log

(P5020-T7200)Debug( 194): 04/19/22 12:21:46:599 GPCP: UI language id is 00000809, locale name is en-GB
(P5020-T7200)Debug( 211): 04/19/22 12:21:46:599 GPCP: resource dll name: PanGPA_ENGLISH.dll
(P5020-T7200)Debug( 212): 04/19/22 12:21:46:599 GPCP: resource dll path: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_ENGLISH.dll
(P5020-T7200)Debug( 219): 04/19/22 12:21:46:599 GPCP: load resurce dll failed!
(P5020-T7200)Debug( 73): 04/19/22 12:21:46:599 PanConf: no 3rd party provider
(P5020-T7200)Debug( 656): 04/19/22 12:21:46:599 PanCP: CreateInstance.
(P5020-T7200)Debug(1182): 04/19/22 12:21:46:599 GPPrelogon: Prelogon is disabled.
(P5020-T7200)Debug( 72): 04/19/22 12:21:46:715 PanCP: SetUsageScenario cpus = 1, dwFlags = 0x00000000
(P5020-T7200)Debug( 86): 04/19/22 12:21:46:797 DomainName: HQ
(P5020-T7200)Debug( 118): 04/19/22 12:21:46:816 PanCred:Initialize enter
(P5020-T7200)Debug( 209): 04/19/22 12:21:46:816 PanCred::Initialize return S_OK
(P18644-T248)Debug( 209): 04/17/22 16:32:07:725 PanCred::Initialize return S_OK

pan_gp_event.log

04/13/2022 18:16:49:987 [Info ]: Gateway RI_External_Gateway: Checking network availability and restoring VPN connection when network is available.
04/13/2022 18:17:34:331 [Info ]: Tunnel is restored.
04/13/2022 18:24:41:295 [Info ]: Completed HIP Report check with Gateway  x.x.x.x
04/13/2022 18:54:43:291 [Info ]: Completed HIP Report check with Gateway  x.x.x.x
04/13/2022 18:54:43:445 [Info ]: HIP Report submitted to the Gateway  x.x.x.x
04/13/2022 19:25:12:449 [Info ]: Completed HIP Report check with Gateway  x.x.x.x
04/13/2022 19:25:12:634 [Info ]: HIP Report submitted to the Gateway  x.x.x.x
04/13/2022 20:25:12:348 [Info ]: Completed HIP Report check with Gateway x.x.x.x
04/13/2022 21:25:12:913 [Info ]: Completed HIP Report check with Gateway x.x.x.x
04/13/2022 21:25:13:087 [Info ]: HIP Report submitted to the Gateway x.x.x.x
04/13/2022 21:38:18:501 [Info ]: Tunnel is down due to disconnection.
04/13/2022 21:38:35:815 [Info ]: User was logged out of Gateway x.x.x.x
04/13/2022 21:38:35:816 [Info ]: GlobalProtect app is disabled.

PanGPS.log

(P6016-T6020)Debug( 348): 04/14/22 20:22:52:492 Received session change, event type 8, session 1
(P6016-T6020)Info ( 428): 04/14/22 20:23:39:617 Received power event, type 0x0000000a
(P6016-T6020)Info ( 428): 04/14/22 20:23:46:393 Received power event, type 0x0000000a
(P6016-T6020)Info ( 428): 04/14/22 20:24:18:354 Received power event, type 0x0000000a
(P6016-T6020)Info ( 428): 04/14/22 20:24:24:419 Received power event, type 0x0000000a
(P6016-T6020)Info ( 428): 04/14/22 20:30:26:401 Received power event, type 0x0000000a
(P6016-T6020)Info ( 428): 04/14/22 20:30:41:567 Received power event, type 0x0000000a
(P6016-T6020)Info ( 428): 04/14/22 20:30:42:066 Received power event, type 0x0000000a
(P6016-T6020)Info ( 428): 04/14/22 20:30:42:127 Received power event, type 0x0000000a
(P6016-T14836)Info ( 246): 04/14/22 20:33:39:366 HipCheckThread: got check hip event or time out.
(P6016-T14836)Info ( 249): 04/14/22 20:33:39:366 agent not enabled, continue(P6016-T14836)Debug( 216): 04/14/22 20:33:39:366 HipCheckThread: wait for hip check event for 3600000 ms);
(P6016-T6020)Debug( 348): 04/14/22 20:37:14:490 Received session change, event type 7, session 1
(P6016-T6020)Info (1612): 04/14/22 20:37:14:490 lock off session 1
(P6016-T6020)Info ( 366): 04/14/22 20:37:29:348 Received sleep event
(P6016-T6020)Info ( 387): 04/14/22 20:38:51:538 Received resume event
(P6016-T6020)Info ( 376): 04/14/22 20:38:51:918 Received resume-auto event
(P6016-T6020)Debug(7091): 04/14/22 20:38:51:918 HandleResumeCallback calls ProcessServerSleep
(P6016-T6020)Info (2065): 04/14/22 20:38:51:918 ProcessServerSleep called
(P6016-T6020)Debug( 198): 04/14/22 20:38:51:918 Now is 449798125. CheckHipTimeoutAfterSleep: 85395000 ms
(P6016-T6020)Debug( 772): 04/14/22 20:38:51:918 m_bScheduleFlag is set to 0
(P6016-T6020)Debug( 201): 04/14/22 20:38:51:918 Time has elapsed 85395000 ms since last hip check. Set hip check event.
(P6016-T6020)Debug(2089): 04/14/22 20:38:51:918 Out-of-sleep not during network discovery.
(P6016-T6020)Debug(2102): 04/14/22 20:38:51:918 No need to set event since NetworkDiscover thread is not running
(P6016-T14836)Info ( 246): 04/14/22 20:38:51:918 HipCheckThread: got check hip event or time out.
(P6016-T6020)Debug(2133): 04/14/22 20:38:51:918 State is Disconnected
(P6016-T14836)Info ( 249): 04/14/22 20:38:51:918 agent not enabled, continue(P6016-T14836)Debug( 216): 04/14/22 20:38:51:918 HipCheckThread: wait for hip check event for 3600000 ms);
(P6016-T6020)Debug( 348): 04/14/22 20:39:21:931 Received session change, event type 8, session 1
(P6016-T6020)Info ( 428): 04/14/22 20:43:29:205 Received power event, type 0x0000000a
(P6016-T6020)Debug( 348): 04/14/22 20:48:27:679 Received session change, event type 7, session 1
(P6016-T6020)Info (1612): 04/14/22 20:48:27:679 lock off session 1
(P6016-T6020)Info ( 428): 04/14/22 20:49:53:629 Received power event, type 0x0000000a
(P6016-T6020)Debug( 348): 04/14/22 20:50:07:306 Received session change, event type 8, session 1
(P6016-T6020)Info ( 428): 04/14/22 20:50:45:027 Received power event, type 0x0000000a
(P6016-T6020)Info ( 428): 04/14/22 20:54:27:775 Received power event, type 0x0000000a
(P6016-T6020)Info ( 428): 04/14/22 20:54:31:564 Received power event, type 0x0000000a

[TimMurphy]

Did you find a resolution to this issue?

[zoquierd-hss]

I am havng similar issues if anyone has an answer please share.

(P1804-T4864)Debug(1127): 06/19/23 14:43:08:420 GPPrelogon: quit monitoring thread due to quit event
(P1216-T14488)Debug( 194): 06/20/23 11:42:36:271 GPCP: UI language id is 00000409, locale name is en-US
(P1216-T14488)Debug( 211): 06/20/23 11:42:36:271 GPCP: resource dll name: PanGPA_ENGLISH.dll
(P1216-T14488)Debug( 212): 06/20/23 11:42:36:271 GPCP: resource dll path: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_ENGLISH.dll
(P1216-T14488)Debug( 219): 06/20/23 11:42:36:272 GPCP: load resurce dll failed!
(P1216-T14488)Debug( 656): 06/20/23 11:42:36:272 PanCP: CreateInstance.
(P1216-T14488)Debug(1169): 06/20/23 11:42:36:273 GPPrelogon: Start PrelogonMonintorThread...
(P1216-T12444)Debug(1113): 06/20/23 11:42:36:274 GPPrelogon: mointoring Prelogon state.
(P1216-T12444)Debug(1127): 06/20/23 11:43:05:836 GPPrelogon: quit monitoring thread due to quit event