Under PaloAlto Networks folder you will find a folder named PANGPS, can you please check to see an instance of user name is ___empty_username___, domain name is. Also few important things to consider For GlobalProtect SSO to work as expected, only the following two credential provider filters must be present: Palo Alto Networks credential provider filter Native Microsoft credential provider filter Follow the steps below to view them: Open regedit.exe Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters Our Credential Provider Filter Native Microsoft Credential Provider Filter If there are any third party credential provider filters apart from the ones mentioned above, they would interfere with the SSO engine and cause the domain and username to show up blank in the PANGPS.log
... View more
