Who rated this post

If you have enabled pre-logon then check if also the windows reg keys are not changed for before logon as prelogon and before logon can't work together:

''''

The Pre-logon and Pre-logon then On-demand connection methods are not supported simultaneously with Connect Before Logon.

'''

Connect Before Logon (paloaltonetworks.com)

The Before logon is a new option that Windows 10 has for vpn agents like globalprotect  called in windows "providers" where when you logon to your computer you also logon with the same credentials at the same time to the VPN agent and it is just a simple change of windows reg keys and to have globalprotect 5.2 or newer:

Deploy Connect Before Logon Settings in the Windows Registry (paloaltonetworks.com)

As I mentioned you either go with before logon or prelogon as to allow the computer for  example to connect to an active directory server for some scripts during boot up and for prelogon it is for the best to be with machine certificates that are always on the device. Also the prelogon option is seen on the windows credentials provider screen not only the "Before logon" shows up:

"""""""""'

The GlobalProtect Credential Provider logon screen for Windows 7 and Windows 10 endpoints also displays the pre-logon connection status prior to user login, which allows end users to determine whether they can access network resources upon login. If the GlobalProtect app detects an endpoint as internal, the logon screen displays the 

 pre-logon connection status. If the Globalprotect app detects an endpoint as external, the logon screen displays the 

 or 

 pre-logon connection status.

"""""""""""""""""""'

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEYCA0

Remote Access VPN with Pre-Logon (paloaltonetworks.com)