Add one or more endpoint operating system (OS) to specify which endpoints receive this configuration. The portal automatically learns the OS of the endpoint and incorporates details for that OS in the client configuration. You can select Any OS or a specific OS (Android, Chrome, iOS, IoT, Linux, Mac, Windows, or WindowsUWP).

Add the specific users or user groups to which this configuration applies.

To deploy this configuration to all users, select any from the User/User Group drop-down. To deploy this configuration only to users with GlobalProtect apps in pre-logon mode, select pre-logon from the User/User Group drop-down.

Configure matching criteria based on whether the endpoint serial number exists in the Active Directory.

Select the certificate profile that the GlobalProtect portal uses to match the machine certificate sent by the GlobalProtect app.

Select this option to define custom host information to match.

To check Windows endpoints for a specific registry key, Add the Registry Key for which to match. To match only the endpoints that lack the specified registry key or key value, enable the Key does not exist or match the specified value data option. To match on specific values, Add the Registry Value and Value Data. To match endpoints that do not have the specified registry value, select Negate.When you select the Negate option, you must leave the Value Data field empty.You can select the Negate option for a Registry Value in Custom Checks in the GlobalProtect Portal that does not have the specified registry value (matching the absence of registry value).