Who Me Too'd this solution

@Sec101 

1) Just run the update, there is no need to be completely uninstalling GP and re-installing the agent completely. In fact, by default the installer does a pretty bad job of cleaning up after itself when you do an uninstall. 

2) It actually runs the following when you push an upgrade from the firewall.

echo off 
set /a _count=0
"C:\WINDOWS\system32\sc.exe" stop pangps > null
:loop
if %_count% GTR 300 goto exittimeout
"C:\WINDOWS\system32\timeout.exe" /t 3 /nobreak > null
set /a _count=_count + 3
"C:\WINDOWS\system32\sc.exe" query pangps | find "STOPPED"
if errorlevel 1 goto loop
cd C:\Program Files\Palo Alto Networks\GlobalProtect
"C:\WINDOWS\system32\msiexec.exe" /x "{1E447623-3102-407C-AF0F-ACF4C5141A68}" /qn /norestart KEEPREGISTRIES="YES" /l+* "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPMsi.log" 
"C:\WINDOWS\system32\msiexec.exe" /norestart /qn /i "C:\WINDOWS\TEMP\globalprotect.msi" TARGETDIR="C:\Program Files\Palo Alto Networks\GlobalProtect"  CERTIFICATESTORELOOKUP="user-and-machine" CACUNPLUGBEHAVE="yes" USEPROXY="yes" PORTAL="*" BENICE="yes" /l+* "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPMsi.log" 
goto normalexit
:exittimeout
echo %date% %time% - PanGPS service cannot be stopped. time out 300. >> "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log"
exit 1
:normalexit