11-14-2023 02:24 PM
I've found the answer. The PC had a remnant of Cisco AnyConnect left behind after the product was uninstalled. I was able to rename this registry entry: HKEY_CLASSES_ROOT\CLSID\{9e871141-0120-4c3e-aba2-8f99335b69c1} so that it’s not found, e.g. 9e871141-0120-4c3e-aba2-8f99335b69c1XXX. This is “Cisco AnyConnect Network Access Manager Notify Object”, and it’s interfering with the Global Protect driver installation.
How I found this:
Run ProcessMonitor and filter on PanGPS.exe before you try to connect in Global Protect (you may have to restart the PanGPS service to get it to try to install the driver).
Check C:\Windows\INF\setupapi.dev.log and look for this:
dvi: {DIF_REMOVE} 10:05:30.212
dvi: Default installer: Enter 10:05:30.212
dvi: {Remove DEVICE}
dvi: {Delete Device - ROOT\PANGPD\0000}
dvi: Query-and-Remove succeeded
dvi: {Delete Device - exit(0x00000000)}
dvi: {Remove DEVICE exit (0x00000000)}
dvi: Default installer: Exit
dvi: {DIF_REMOVE - exit(0x00000000)} 10:05:30.231
and note the timestamp: 10:05:30.212. In ProcessMonitor at that timestamp, you should find an entry such as:
CreateFile C:\Windows\INF\setupapi.dev.log
This is where PanGPS is writing the DIF_REMOVE entries to setupapi.dev.log. Immediately preceding that in ProcessMonitor, I saw where PanGPS was accessing the registry with
RegOpenKey HKCR\CLSID\{9E871141-0120-4C3E-ABA2-8F99335B69C1}As this was the last entry before the DIF_REMOVE was issued, I suspected that this might what was causing PanGPS to remove the driver. I renamed the registry key as described above so that it wouldn't be found, and viola, everything started working.
