Where Does GlobalProtect Store Portal Cache and Logs?
Where GlobalProtect keeps portal cache, logs and agent files on Windows.
Last updated
The GlobalProtect agent splits across two roots: binaries, drivers and pre-logon cache under Program Files\Palo Alto Networks\GlobalProtect, plus per-user portal configs, cookies and PanGPA.log under LocalAppData. PanPortalCfg files are the cached portal state.
Pre-logon tunnels read the Program Files copy while logged in sessions use the user copy. Registry keys mirror the cache, so full cleanup touches both files and the PanGPS registry entries before restarting the service.
Where GlobalProtect stores this, by platform
%LOCALAPPDATA%\Palo Alto Networks\GlobalProtect\
Per-user portal cache (PanPortalCfg files), auth cookies and PanGPA.log. Pre-logon cache lives separately under Program Files. Restart the PanGPS service after clearing.
Frequently asked questions
How do I clear a stale GlobalProtect portal cache?
Delete PanPortalCfg files from the user GlobalProtect folder and clear the matching registry values, then restart the PanGPS service. The client refetches fresh portal config on next connect.
GlobalProtect says Using Cached Portal. What does that mean?
Check PanGPA.log in the user folder first. It records whether the client fell back to cached portal config and why the live portal was unreachable, which decides between network fixes and cache clearing.
Notice an outdated path? Let us know.