Install GlobalProtect for IoT on Windows
Focus
Focus
GlobalProtect

Install GlobalProtect for IoT on Windows

Table of Contents
End-of-Life (EoL)

Install GlobalProtect for IoT on Windows

Devices running Windows 10 IoT can use the GlobalProtect app. Use your organization’s distribution method, such as Microsoft System Center Configuration Manager (SCCM), to deploy and install the GlobalProtect app on your IoT devices running Windows 10 IoT Enterprise.
A GlobalProtect Windows IoT deployment supports certificate-based authentication. You must install the certificate used for authentication on each IoT device in its local machine store. If an IoT device has multiple certificates with the same Root CA, GlobalProtect uses the first certificate in the IoT device’s local machine store to authenticate; be sure that your certificates are in the correct order in your devices.
The following sections describe how to install the GlobalProtect app on devices running Windows IoT:

Download and Install the MSIEXEC File on the IoT Device

You can download and install the msiexec.exe file to your IoT devices to install the GlobalProtect app for the On-Demand connect method or Always On connect method. You use the same method to deploy the msiexec.exe file as you do on a non-IoT device.

Modify the Registry Keys on the IoT Device (On-Demand or Always On)

You must specify the OS type as IoT, the device type as headless, and the portal address. Optionally, you can specify a username and password. If you do not specify a username and password, GlobalProtect uses certificate-based authentication.
You can use the following methods of installation for the On-Demand connect method or Always On connect method:
  • Specify the OS Type (Required):
    Registry subkey: \HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings
    Name: os-type
    Type: REG_SZ
    Data: IoT
  • Specify a headless IoT device (Required):
    Registry subkey: \HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings
    Name: head-less
    Type: REG_SZ
    Data: yes
  • Specify the portal address (Required):
    Registry subkey: \HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup
    Name: Portal
    Type: REG_SZ
    Data: Enter the GlobalProtect portal’s IP address or FQDN.
  • Specify the username (Optional):
    Registry subkey: \HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings
    Name: username
    Type: REG_SZ
    Data: Enter the user name to use with the IoT device.
  • Specify the password (Optional):
    Registry subkey: \HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings
    Name: password
    Type: REG_SZ
    Data: Enter the password to use with the IoT device.

Modify the Registry Keys on the IoT Device (Always On with Pre-logon)

You must specify the portal address, the pre-logon timeout value, and the service-only value. You must delete the GlobalProtect value to prevent the IoT device from automatically launching the app interface upon system restart. A pre-logon VPN tunnel does not associate the username because the user has not logged in.
You can use the following methods of installation for the Pre-logon (Always On) connect method:
  • Specify the portal address (Required):
    Registry subkey: \HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup
    Name: Portal
    Type: REG_SZ
    Data: Enter the GlobalProtect portal’s IP address or FQDN.
  • Specify the pre-logon value (Required):
    Registry subkey: \HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup
    Name: Prelogon
    Type: REG_SZ
    Data: 1
  • Specify the service-only value (Required):
    Registry subkey: \HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings
    Name: service-only
    Type: REG_SZ
    Data: yes
  • Delete the GlobalProtect value (Required):
    Registry subkey: \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    Name: GlobalProtect
    Type: REG_SZ