GSA Windows client prerequisites and installation
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 038f794 · +32 −32 lines · also on GitHub
⋯ 36 unchanged lines
3737
3838
- Local admin credentials to install or upgrade the Global Secure Access client.
3939
40
−- A license. For details, see the licensing section of [What is Global Secure Access](overview-what-is-global-secure-access.md). If necessary, you can [buy licenses or get trial licenses](https://aka.ms/azureadlicense).
40
+- A license. For details, see the licensing section of [What is Global Secure Access?](overview-what-is-global-secure-access.md). If necessary, you can [buy licenses or get trial licenses](https://aka.ms/azureadlicense).
4141
4242
## Steps for downloading the client
4343
44
−The most current version of the Global Secure Access client is available to download from the Microsoft Entra admin center.
44
+The most current version of the Global Secure Access client is available to download from the Microsoft Entra admin center:
4545
4646
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) as a [Global Secure Access Administrator](/azure/active-directory/roles/permissions-reference#global-secure-access-administrator).
4747
⋯ 7 unchanged lines
5555
5656
### Automated installation
5757
58
−Organizations can install the Global Secure Access client silently with the `/quiet` switch. Or they can use solutions for mobile device management, such as [Microsoft Intune](/mem/intune/apps/apps-win32-app-management), to deploy the client to their devices.
58
+Organizations can install the Global Secure Access client silently by using the `/quiet` switch. Or they can use solutions for mobile device management, such as [Microsoft Intune](/mem/intune/apps/apps-win32-app-management), to deploy the client to their devices.
5959
6060
### Use Microsoft Intune to deploy the Global Secure Access client
6161
⋯ 5 unchanged lines
6767
6868
#### Package the client
6969
70
−Package the installation script into a `.intunewin` file:
70
+Package the installation script into an `.intunewin` file:
7171
7272
1. Save the following PowerShell script to your device. Put the PowerShell script and the Global Secure Access `.exe` installer into a folder.
7373
⋯ 98 unchanged lines
172172
173173
1. Go to the [Microsoft Win32 Content Prep Tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). Select `IntuneWinAppUtil.exe`.
174174
175
− :::image type="content" source="media/how-to-install-windows-client/install-content-prep-tool.png" alt-text="Screenshot of selecting the installaton file in the prep tool.":::
175
+ :::image type="content" source="media/how-to-install-windows-client/install-content-prep-tool.png" alt-text="Screenshot of selecting the installation file in the prep tool.":::
176176
177177
1. In the upper-right corner, select **More file actions** and then select **Download**.
178178
⋯ 268 unchanged lines
447447
1. In the **Settings picker**, search for **QUIC**.
448448
1. From the search results:
449449
1. Select **Microsoft Edge**, and then select the **Allow QUIC protocol** setting.
450
− 1. Select **Google Google Chrome**, and then select the **Allow QUIC protocol** setting.
450
+ 1. Select **Google Chrome**, and then select the **Allow QUIC protocol** setting.
451451
1. In the **Settings picker**, search for **DNS-over-HTTPS**.
452452
1. From the search results:
453453
1. Select **Microsoft Edge**, and then select the **Control the mode of DNS-over-HTTPS** setting.
454
− 1. Select **Google Google Chrome**, and then select the **Control the mode of DNS-over-HTTPS** setting.
454
+ 1. Select **Google Chrome**, and then select the **Control the mode of DNS-over-HTTPS** setting.
455455
1. Close the **Settings picker**.
456456
457457
1. For **Google Chrome**, set both toggles to **Disabled**.
⋯ 182 unchanged lines
640640
641641
### Troubleshooting view
642642
643
−In the **Troubleshooting** view, you can perform various diagnostic tasks. You can export and share logs with your IT admin. You can also access the **Advanced diagnostics** tool, which provides an assortment of troubleshooting tools. (You can also open the **Advanced diagnostics** tool from the menu for the client's system tray icon.
643
+In the **Troubleshooting** view, you can perform various diagnostic tasks. You can export and share logs with your IT admin. You can also access the **Advanced diagnostics** tool, which provides an assortment of troubleshooting tools. (You can also open the **Advanced diagnostics** tool from the icon menu in the client's system tray.)
644644
645645
:::image type="content" source="media/how-to-install-windows-client/client-interface-troubleshooting.png" alt-text="Screenshot of the Troubleshooting view of the Global Secure Access client interface.":::
646646
⋯ 37 unchanged lines
684684
|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-connected.png"::: |Global Secure Access - Connected |The client is connected to Global Secure Access. |
685685
|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-disabled.png"::: |Global Secure Access - Disabled |The client is disabled because services are offline or the user disabled the client. |
686686
|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-disconnected.png"::: |Global Secure Access - Disconnected |The client failed to connect to Global Secure Access. |
687
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Some channels are unreachable |The client is partially connected to Global Secure Access (that is, the connection to at least one channel failed: Microsoft Entra, Microsoft 365, Private Access, Internet Access). |
688
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Disabled by your organization |Your organization disabled the client (that is, all traffic forwarding profiles are disabled). |
687
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Some channels are unreachable |The client is partially connected to Global Secure Access. That is, the connection to at least one channel failed: Microsoft Entra, Microsoft 365, Private Access, Internet Access. |
688
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Disabled by your organization |Your organization disabled the client. That is, all traffic forwarding profiles are disabled. |
689689
|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - Private Access is disabled |The user disabled Private Access on this device. |
690
−|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - could not connect to the Internet |The client couldn't detect an internet connection. The device is either connected to a network that doesn't have an Internet connection or a network that requires captive portal sign in. |
690
+|:::image type="icon" source="media/how-to-install-windows-client/global-secure-access-client-icon-warning.png"::: |Global Secure Access - could not connect to the Internet |The client couldn't detect an internet connection. The device is either connected to a network that doesn't have an Internet connection or connected to a network that requires captive portal sign in. |
691691
692692
## Known limitations
693693
⋯ 1 unchanged line
695695
696696
## Troubleshooting
697697
698
−To troubleshoot the Global Secure Access client, select the client icon in the taskbar and select one of the troubleshooting options: **Export logs** or **Advanced diagnostics tool**.
698
+To troubleshoot the Global Secure Access client, select the client icon on the taskbar and select one of the troubleshooting options: **Export logs** or **Advanced diagnostics tool**.
699699
700700
> [!TIP]
701701
> Administrators can modify the Global Secure Access client menu options by revising the [Client registry keys](#client-registry-keys).
⋯ 5 unchanged lines
707707
708708
## Security recommendations
709709
710
−To enhance the security of the Global Secure Access client, use the following configurations:
710
+To enhance the security of the Global Secure Access client, use the following configurations.
711711
712712
### Upgrade to the latest client version
713713
714
−Regularly test and deploy the latest Global Secure Access client release to take advantage of new features, performance improvements, and security fixes. Download the latest version of the [Global Secure Access client](#download-the-client) from the Microsoft Entra admin center.
714
+Regularly test and deploy the latest Global Secure Access client release to take advantage of new features, performance improvements, and security fixes. Download the latest version of the [Global Secure Access client](#steps-for-downloading-the-client) from the Microsoft Entra admin center.
715715
716716
### Restrict nonprivileged users from disabling the client
717717
718
−Administrators can prevent nonprivileged users on Windows devices from disabling or enabling the Global Secure Access client. This restriction ensures that the client stays on and that Global Secure Access continues to authenticate and secure network traffic. Enabling this restriction requires elevated privileges to disable the client.
718
+Administrators can prevent nonprivileged users on Windows devices from disabling or enabling the Global Secure Access client. This restriction ensures that the client stays on and that Global Secure Access continues to authenticate and help secure network traffic. Enabling this restriction requires elevated privileges to disable the client.
719719
720
−Before enforcing this restriction, let users work with the Global Secure Access client in a nonrestricted mode. Configure the client for your organization to ensure users don't need to disable the client in specific scenarios (for example, to access specific websites or to use a non-Microsoft VPN in parallel).
720
+Before you enforce this restriction, let users work with the Global Secure Access client in a nonrestricted mode. Configure the client for your organization to ensure that users don't need to disable the client in specific scenarios (for example, to access specific websites or to use a non-Microsoft VPN in parallel).
721721
722
−To stop the Global Secure Access client on a device with restricted, nonprivileged users, make sure that there's a process in place to use a user with local administrator privileges when necessary. For more information regarding restricting nonprivileged users, see [Restrict nonprivileged users](#restrict-nonprivileged-users).
722
+To stop the Global Secure Access client on a device with restricted, nonprivileged users, make sure that there's a process in place to use a user with local administrator privileges when necessary. For more information about restricting nonprivileged users, see [Restrict nonprivileged users](#restrict-nonprivileged-users).
723723
724724
### Hide the Disable button
725725
726
−In addition to restricting nonprivileged users from disabling the client, administrators can hide the **Disable** button in the client system tray icon menu. Removing the **Disable** button from view further reduces the likelihood that users disable the client by accident or without authorization.
726
+In addition to restricting nonprivileged users from disabling the client, administrators can hide the **Disable** button on the icon menu in the client's system tray. Removing the **Disable** button from view further reduces the likelihood that users disable the client by accident or without authorization.
727727
728728
For more information regarding hiding client menu buttons, see [Hide or unhide system tray menu buttons](#hide-or-unhide-system-tray-menu-buttons).
729729
730730
## Client registry keys
731731
732
−The Global Secure Access client uses specific registry keys to enable or disable different functionalities. Administrators can use a solution for mobile device management, such as Microsoft Intune or Group Policy, to control the registry values.
732
+The Global Secure Access client uses specific registry keys to enable or disable functionalities. Administrators can use a solution for mobile device management, such as Microsoft Intune or Group Policy, to control the registry values.
733733
734734
> [!CAUTION]
735
−> Don't change other registry values unless instructed by Microsoft Support.
735
+> Don't change other registry values unless Microsoft Support instructs you to.
736736
737737
### Restrict nonprivileged users
738738
⋯ 2 unchanged lines
741741
742742
|Value |Type |Data |Description |
743743
|-------|------|------|-------------|
744
−|RestrictNonPrivilegedUsers |REG_DWORD |0x0 |Nonprivileged users on the Windows device can disable and enable the client. |
745
−|RestrictNonPrivilegedUsers |REG_DWORD |0x1 |Nonprivileged users on the Windows device are restricted from disabling and enabling the client. A UAC prompt requires local administrator credentials for disable and enable options. The administrator can also hide the disable button (see [Hide or unhide system tray menu buttons](#hide-or-unhide-system-tray-menu-buttons)). |
744
+|`RestrictNonPrivilegedUsers` |`REG_DWORD` |`0x0` |Nonprivileged users on the Windows device can disable and enable the client. |
745
+|`RestrictNonPrivilegedUsers` |`REG_DWORD` |`0x1` |Nonprivileged users on the Windows device are restricted from disabling and enabling the client. A User Account Control (UAC) prompt requires local administrator credentials for disable and enable options. The administrator can also hide the disable button (see [Hide or unhide system tray menu buttons](#hide-or-unhide-system-tray-menu-buttons)). |
746746
747747
### Disable or enable Private Access on the client
748748
⋯ 9 unchanged lines
758758
759759
|Value |Type |Data |Description |
760760
|-------|------|------|-------------|
761
−|IsPrivateAccessDisabledByUser |REG_DWORD |0x0 |Private Access is enabled on this device. Network traffic to private applications goes through Global Secure Access. |
762
−|IsPrivateAccessDisabledByUser |REG_DWORD |0x1 |Private Access is disabled on this device. Network traffic to private applications goes directly to the network. |
761
+|`IsPrivateAccessDisabledByUser` |`REG_DWORD` |`0x0` |Private Access is enabled on this device. Network traffic to private applications goes through Global Secure Access. |
762
+|`IsPrivateAccessDisabledByUser` |`REG_DWORD` |`0x1` |Private Access is disabled on this device. Network traffic to private applications goes directly to the network. |
763763
764764
:::image type="content" source="media/how-to-install-windows-client/global-secure-access-registry-key-private-access-enabled.png" alt-text="Screenshot of the Registry Editor with the IsPrivateAccessDisabledByUser registry key highlighted.":::
765765
766
−If the registry value doesn't exist, the default value is 0x0, Private Access is enabled.
766
+If the registry value doesn't exist, the default value is `0x0` and Private Access is enabled.
767767
768768
### Hide or unhide system tray menu buttons
769769
770
−Administrators can show or hide specific buttons in the client system tray icon menu. Create the values under the following registry key:
770
+Administrators can show or hide specific buttons on the icon menu in the client's system tray. Create the values under the following registry key:
771771
`Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Global Secure Access Client`.
772772
773773
|Value |Type |Data |Default behavior |Description |
774774
|---------|---------|---------|---------|---------|
775
−|HideSignOutButton |REG_DWORD |0x0 - shown 0x1 - hidden |hidden |Configure this setting to show or hide the **Sign out** action. This option is for specific scenarios when a user needs to sign in to the client with a different Microsoft Entra user than the one used to sign in to Windows. Note: You must sign in to the client with a user in the same Microsoft Entra tenant to which the device is joined. You can also use the **Sign out** action to reauthenticate the existing user. |
776
−|HideDisablePrivateAccessButton |REG_DWORD |0x0 - shown 0x1 - hidden |hidden |Configure this setting to show or hide the **Disable Private Access** action. This option is for a scenario when the device is directly connected to the corporate network and the user prefers accessing private applications directly through the network instead of through the Global Secure Access. |
777
−|HideDisableButton |REG_DWORD |0x0 - shown 0x1 - hidden |shown |Configure this setting to show or hide the **Disable** action. When visible, the user can disable the Global Secure Access client. The client remains disabled until the user enables it again. If the **Disable** action is hidden, a nonprivileged user can't disable the client. |
775
+|`HideSignOutButton` |`REG_DWORD` |`0x0` - shown `0x1` - hidden |Hidden |Configure this setting to show or hide the **Sign out** action. This option is for specific scenarios when a user needs to sign in to the client with a different Microsoft Entra user than the one used to sign in to Windows. Note: You must sign in to the client with a user in the same Microsoft Entra tenant to which the device is joined. You can also use the **Sign out** action to reauthenticate the existing user. |
776
+|`HideDisablePrivateAccessButton` |`REG_DWORD` |`0x0` - shown `0x1` - hidden |Hidden |Configure this setting to show or hide the **Disable Private Access** action. This option is for a scenario when the device is directly connected to the corporate network and the user prefers accessing private applications directly through the network instead of through Global Secure Access. |
777
+|`HideDisableButton` |`REG_DWORD` |`0x0` - shown `0x1` - hidden |Shown |Configure this setting to show or hide the **Disable** action. When visible, the user can disable the Global Secure Access client. The client remains disabled until the user enables it again. If the **Disable** action is hidden, a nonprivileged user can't disable the client. |
778778
779779
:::image type="content" source="media/how-to-install-windows-client/global-secure-access-registry-key-private-hide-signout.png" alt-text="Screenshot of the Registry Editor with the HideSignOutButton and HideDisablePrivateAccessButton registry keys highlighted.":::
780780
⋯ 1 unchanged line
782782
783783
## Related content
784784
785
−- [Global Secure Access client for macOS](how-to-install-macos-client.md)
786
−- [Global Secure Access client for Android](how-to-install-android-client.md)
787
−- [Global Secure Access client for iOS](how-to-install-ios-client.md)
785
+- [Install the Global Secure Access client for macOS](how-to-install-macos-client.md)
786
+- [Install the Global Secure Access client for Android](how-to-install-android-client.md)
787
+- [Install the Global Secure Access client for iOS](how-to-install-ios-client.md)
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:31 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.