Palo Alto GlobalProtect Hotfix Versions

[jmoock]

When hotfix versions are released for GlobalProtect, since the detection rules look at the registry (which only contains the X.Y.Z portion of the version, ex: 6.2. the updates are shown as being already installed in Intune/WSUS.  Can future detection rules look at something that includes the revision number, such as the version of the PanGPS executable which includes the release version (ex: 6.2.8.317) or possibly the MSI product ID (if it in fact changes in hotfix releases) so that GlobalProtect hotfixes can be reliably deployed with PatchMyPC?

Thank you

[Andrew Jimenez (Patch My PC)]

We are working on this; we have found a way to improve the WSUS rules easily enough and will do so in the coming weeks. As for the Intune detection, that will require a major rework on our detection rules, as almost every other product in our catalog provide the full version number in the ARP registry. We've asked customers to reach out to Palo and request the full version number be provided in ARP for easy detection, and they have provided other registry values to key off of instead...

[davidlettice]

We're also having issues with this, where it perceives 6.3.3-676 to be the same as 6.3.3-633, and therefore doesn't push out any updates until it hits 6.3.4

One "workaround" we've found is to change the app itself to use a custom detection method:

Path: HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup
Name: CurrentVersion
Method: String Comparison
Operator: Equals
Value: 6.3.3-676 (or your version number)

The downside with this that it will treat this as a first-time deployment and ignores the update rings we have in place - something that for a business critical app just doesn't work for us.

[Andrew Jimenez (Patch My PC)]

That extra info is helpful, and we are hoping to utilize it to better support this app in the near future! Thanks!