If you
Enforce GlobalProtect for
Network Access
in a GlobalProtect portal agent configuration,
and then you upgrade a Windows endpoint to a newer version of the
GlobalProtect app, installation can fail and the enforcement configuration
can block all traffic.