GlobalProtect credentials for RDP

[RomainCouvreur]

Hello Community,

Customer is using Global Protect with SSO and RDP and he would like to know why does Globalprotect asks for credentials (internal portal) when a user logs through RDP?

For example, if the user logs locally the SSO works fine and Globalprotect can connect with the user's domain credentials.

However, if the user logs in the same machine with the same credentials but using RDP, Globalprotect disconnects and asks for credentials.

Is it the expected behavior ?

I have seen  the below option in portal >> Agent >> APP :

----

User Switch Tunnel Rename Timeout (sec) : Specify the number of seconds that a remote user has to be authenticated by a GlobalProtect gateway after logging into an endpoint by using Microsoft’s Remote Desktop Protocol (RDP) (range is 0 to 600; default is 0). Requiring the remote user to authenticate within a limited amount of time maintains security.

-----

If we modify this setting could it help for the behavior observed ?

Thanks in advance for your reply.

Best regards.

[RomainCouvreur]

Hello Team,

Could I have any feedback on this please ?

Thank you and best regards.

[reaper · Accepted solution]

This is expected behavior

it's insecure to 'give' the connected GP connection to a new user that is hijacking the system using RDP

if you want to be able to allow users to do this, you can indeed change the timer on "User Switch Tunnel Rename Timeout" so the tunnel is not broken immediately, but it will be broken eventually for the new user to log in