Missing api-ms-win-shcore-scaling-l1-1-1.dll on upgrade from 5.2.5-66 to 5.2.5-84 on Windows 7

[Denis_Baudet]

Hi,

We recently upgraded our GlobalProtect clients to 5.2.5-84. Since then, the client won't start on Windows 7 claiming that it cannot find the following file : api-ms-win-shcore-scaling-l1-1-1.dll

On Win 7 x86, we managed to make it work by copying a dll found on a ressource forum but it doesn't with Win 7x64

Does someone encounter the same issue ?

Did someone find a workaround ?

[rcknight]

Unfortunately, GP 5.2 is not supported on windows 7:

https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalp...

[Denis_Baudet]

Yeah, I know that, that's a bit annoying.

Anyway, since there was a workaround on 7 x86, I was hoping to find one for the x64 version.

No luck so far.

Thanks anyway

[eric1708]

Ok, but then is there a way to avoid to client asking to update to the new version each time I launch it? This is becoming really annoying..

Thanks for any help on this.

Eric

[BPry]

@eric1708,

That's a setting that is set on the GlobalProtect portal side of things, not something that you can control on the client side. If you admin the service you are connecting to you can modify this under GlobalProtect Portal -> Agent configs. 

[eric1708]

I have the client on a PC, and I am the admin on this PC, and this is on this PC that the update is requested each time I launch the client. I do not have access to the Agent configs, I think. Hence, I understand there is nothing I can do, except clicking on "no" all the time. Not really nice..

I can understand (maybe..) that the new version has not been developed for Windows 7, but there are a lot of platform still running on Windows 7, and popping up the update windows all the time is definitely annoying, as you can imagine. My Windows 7 platform is planned to run still for years, and I have this update windows several times each day now..

Eric

[cverniani]

I have even some clients that working ok with Windows 7 and Globalprotect 5.2.5 . With the 5.2.6 i report  the error that even you signaled..

Waiting for news. 

Claudio ICT GlemGas

[Akhil_B]

I have one of the client had reported with the same issue. I found a workaround where you have to go in and delete Microsoft visual C++ redistributable packages of 2015(both x86 and x64) & 2017 (if any). But again, it worked for 2 of my clients and then failed on 1. So, not sure about it but its worth giving a try.

[cverniani]

I have read this document updated Apr 12, 2021.

But why 5.2.5 works without problems with Windows 7 and from 5.2.5-c84 and major does not works?

my suggestion are that all 5.2.x continue to work with Windows 7.. and if Paloalto networks want to make a *new *version that does not work with windows 7 ... the call 5.3 and not 5.2.x

Best Regards

[eric1708]

If I may say it:

The situation looks now somewhat pathetic.

Paloalto is now releasing a client that has problems. Sorry but this is the case: Ok maybe to decide that the client will not work on Windows 7 any more - which is already something hardly acceptable (by the way it also apparently does not work on WIndows 8 and 8.1) - but then having this annoying pop-up window asking all the time to update the software while updating it will lead to a system failure looks like a coarse bug, I'm afraid.

And now, this cannot be us (users) that should find a way to workaround this problem, I think (as this seems to be the case in this discussion). Paloalto needs to work properly and produce a client (updated on not) that do not lead to problems (and - I think - that should still work on Windows 7).

Let start with the important things first and put this discussion in the correct order, I think.

Eric.

[e01fe01f · Accepted solution]

Hi,

I managed to get 5.2.7-37 running on Win7 x64. The issue is simply the newer versions use a dll and API that does not exist in 7 but was introduced in 8/8.1 and later versions. This excellent answer on SO explains the specifics if you are interested: https://stackoverflow.com/a/50276714 

Dependency Walker showed that PanGPA.exe only imports one single function from the API-MS-WIN-SHCORE-SCALING-L1-1-1.DLL, SetProcessDpiAwareness(...), so it was easy enough to just roll my own dummy DLL file in Visual Studio 2013 that exports this single function, compile that for x64 and voilá, GlobalProtect is a happy camper.

For the sake of it, I even implemented the function such that it actually makes use of the "legacy" Win7 API to accomplish the same result, SetProcessDPIAware() from user32.dll.

I will try and distribute my dll in binary form, but you are free to just input below code into your copy of VS13 (Create a new C++ DLL project from the menu)  and compile your own DLL file if you don't trust me. It's literally a one-liner.

In your header, put something like this:

typedef enum PROCESS_DPI_AWARENESS {
	PROCESS_DPI_UNAWARE,
	PROCESS_SYSTEM_DPI_AWARE,
	PROCESS_PER_MONITOR_DPI_AWARE
};

extern "C" __declspec(dllexport) HRESULT SetProcessDpiAwareness(PROCESS_DPI_AWARENESS value);

In your cpp file, put:

HRESULT SetProcessDpiAwareness(PROCESS_DPI_AWARENESS value) {
	return SetProcessDPIAware();
}

When compiling, make sure you select x64 as your platform from the menu, otherwise GlobalProtect will crash with 0xc000007b (STATUS_INVALID_IMAGE_FORMAT).

When done compiling, make sure your file name is API-MS-WIN-SHCORE-SCALING-L1-1-1.dll and copy the file to C:\Program Files\Palo Alto Networks\GlobalProtect.

If rules in this community allow (dear mods please remove the link if this is not allowed), I uploaded my binary dll file to mega, see https://mega.nz/file/7DgmBaTJ#JUdmDbAY13E0McK6nKbYhD9vjV_IFrpLcvlZRNCg9GQ 

Have fun!

[cverniani]

Good idea. If i understand this dll.,. this Dll can be used *ONLY* on win64 systems?