GlobalProtect machine pre-logon coverted into a user connection without user certificate in device

[MarcelST]

Hi there, we are facing a weird situation with GlobalProtect pre-logon connections.

• We have some laptops with machine certificate only (they do not have user certificates deployed).
• We want them to connect using this machine certificate, as "pre-logon", so they got limited/specific access to some company resources
• They are able to establish GP VPN connection but their session is a normal user connection instead of a pre-logon connection because, somehow, the Machine Certificate value is used as if it were a user. So, in short, this is what I'm saying:
  

These are some useful logs I found in the Tech Support files:

2021/01/14 13:23:05 info globalp GP-Por globalp 0 GlobalProtect portal client configuration generated. Login from: xxx.xxx.xxx.xxx, Source region: ES, User name: 7836523f-2a31-4e61-8583-252ad100fc62, Client OS version: Microsoft Windows 10 Pro , 64-bit, Config name: GP-Agent-HUB01-On-Demand.

2021/01/14 13:23:11 info globalp GP-Gat globalp 0 GlobalProtect gateway user login succeeded. Login from: xxx.xxx.xxx.xxx, Source region: ES, User name: 7836523f-2a31-4e61-8583-252ad100fc62, Client OS version: Microsoft Windows 10 Pro , 64-bit.

2021/01/14 13:23:11 info auth auth-su 0 Certificate validated for user '7836523f-2a31-4e61-8583-252ad100fc62'. From: xxx.xxx.xxx.xxx.

2021/01/14 13:23:12 info globalp GP-Gat globalp 0 GlobalProtect gateway client configuration generated. User name: 7836523f-2a31-4e61-8583-252ad100fc62, Private IP: 10.x.x.39, Client version: 5.1.3-12, Device name: COMMXTF47SVPGIT, Client OS version: Microsoft Windows 10 Pro , 64-bit, VPN type: Device Level VPN.

And this is the GlobalProtect Portal profile they are matching as per the logs (GP-Agent-HUB01-On-Demand):