Since, thus far, Cato SDP doesn't support a "execute after connect" option common on other VPN clients, I am curious how others are triggering the Windows login script to run on endpoints when the Private Access tunnel comes up.
Currently I am using a scheduled task on each endpoint that is triggered by the NetworkProfile log detecting a Domain network. It generally works, but isn't especially reliable since NLASvc itself isn't especially reliable.
I had previously used a trigger based on the Cato virtual network adapter coming up, but when we moved to an Always On policy for Internet access this workflow was no longer viable.
Tried using GPOs on a group of test users but it could take anywhere from a few minutes to over an hour for drives to map, and this was understandably not an acceptable long-term solution for my users.
Has anyone had success with other methods?
For those interested, here is the query string I am using as a custom event filter for the event trigger:
<QueryList>
<Query Id="0" Path="Microsoft-Windows-NetworkProfile/Operational">
<Select Path="Microsoft-Windows-NetworkProfile/Operational">
*[System[(EventID=10000)]] and *[EventData[Data[@Name="Category"]="2"]]
</Select>
</Query>
</QueryList>
Also notable to update AlwaysExpectDomainController and disable LLMNR in the registry or via GPO. Open to any other thoughts on this method as well that may make this more reliable.
