Deploy Scripts Using the Windows Registry

You can enable deployment of custom scripts to Windows endpoints using the Windows Registry.
You can configure the GlobalProtect app to initiate and run a script for any or all of the following events: before and after establishing the tunnel, and before disconnecting the tunnel. To run the script at a particular event, reference the batch script from a command registry entry for that event.
Depending on the configuration settings, the GlobalProtect app can run a script before and after the app establishes a connection to the gateway, and before the app disconnects. Use the following workflow to use the Windows Registry to customize app settings for Windows endpoints.
The registry settings that enable you to deploy scripts are supported on endpoints running GlobalProtect App 2.3 and later releases.
  1. Open the Windows registry, and locate the GlobalProtect app customization settings.
    Open the Windows registry (enter
    regedit
    in the command prompt) and go to one of the following key locations, depending on when you want to execute scripts (pre/post connect or pre disconnect):
    HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\pre-vpn-connect
    HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\post-vpn-connect
    HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\pre-vpn-disconnect
    If the key does not exist within the
    Settings
    key, create it by right-clicking
    Settings
    and selecting
    New
    Key
    ).
  2. Enable the GlobalProtect app to run scripts by creating a new String Value named
    command
    .
    The batch file specified here should contain the specific script (including any parameters passed to the script) that you want run on the device.
    1. If the
      command
      string does not already exist, create it by right-clicking the
      pre-vpn-connect
      ,
      post-vpn-connect
      , or
      pre-vpn-disconnect
      key, selecting
      New
      String Value
      , and naming it
      command
      ).
    2. Right click
      command
      , and then select
      Modify
      .
    3. Enter the commands or script that the GlobalProtect app should run. For example:
      %userprofile%\pre_vpn_connect.bat c: test_user
      deploy-scripts-registry-setting-edit.png
  3. (
    Optional
    ) Add additional registry entries as needed for each command.
    Create or modify registry strings and their corresponding values, including
    context
    ,
    timeout
    ,
    file
    ,
    checksum
    , or
    error-msg
    . For additional information, see Customizable App Settings.

Related Documentation