GlobalProtect Pre-Logon before user logs in.

[Mick_Ball]

we have been using pre-logon for some time and are generally having very few issues.

We now need Pre-Logon to work on newly built laptops using the "Extend Key Usage OID" setting in the GP app.

It works fine but we need it set for when a user first ever logs on as they are being given an option to choose one of 4 certificates.

(yes we use certicates from the computer store..

I have followed this article.....

Manually Set OID Registry for Certificate Selection - Knowledge Base - Palo Alto Networks

but still does not take affect until the user manually chooses a certificate and logs on for the first time.

I then assume the user gets the setting from the portal app but i cannot work out why the reg key is not working as expected.

I thought perhaps this information is stored in the user profile for globalprotect (PanPortalCfg_***) but this file does not change size with the OID "1.3.6.1.4.1.311.10.3.4" in or out of the app config.

any help advice much appreciated...