Disable GlobalProtect VPN Client SSO

VPN
1

Hi All,

What registry setting is required to disable SSO on a Windows box and prompt the user to enter their credentials each time they try to connect using the GlobalProtect VPN client?

Thanks

2

This can be configured in the Portal User Group App config. Network → GP-> Portal.

There’s an app setting about exactly what you’re asking

3

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-apps/deploy-app-settings-transparently/deploy-app-settings-to-windows-endpoints/deploy-app-settings-in-the-windows-regsitry

Ita going to be set again on next login from the settings in your firewall config though.

4

Not sure of the registry setting, but you can do this through the GP settings:

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/authentication/about-globalprotect-user-authentication/supported-globalprotect-authentication-methods/single-sign-on

5

Jinx… great minds and all that.

6

Thank you for this.

I created a registry “string” named “force-sso-disable” with the value set to “yes”, but it still doesn’t prompt to specify a username/password and continues to use the username of the Windows box. Any ideas?

7

I don’t know who you’re saying that to because you all provided different links.

8

Check to see if authentication cookies are enabled. If they are, they will authenticate the user automatically.

9

Hi, thanks for your help.

I agree, their support documentation is poor and their support itself is almost non-existent. I’ll try the can-promp… string and see if this works. Thanks again.