KB44264 - Pulse Secure Credential Provider tile goes missing intermittently when enabled in Pulse Desktop Client installed on Windows 10

Pulse Secure Credential Provider tile goes missing intermittently when enabled in Pulse Desktop Client installed on Windows 10

When Credential Provider is enabled on Pulse Desktop Client it is supposed to present a credential provider tile that appears on the user login screen by adding a Pulse icon in the lower right corner of the tile.

However in certain scenarios post reboot or  resuming from a shutdown this tile wouldn't be present on the user logon screen which would eventually lead to a SSO failure.

This applies to both the "user-at-credprov" & "machine-then-user-at-credprov" connection types for Wired & Wireless 802.1x scenarios. 

Our R&D team suspects that this might be due to the following limitation with Microsoft Windows OS
https://support.microsoft.com/en-in/help/3063910/sso-with-pre-logon-fails-during-user-logon-after-a-restart

For Pulse Credential provider tile to show up on the Windows login screen, Pulse credential provider filter should be notified about OneX credential providers. Pulse relies on Microsoft windows native Pre-Logon Authentication Provider  (PLAP) logon filter for this functionality.

Owing to a race condition between the PLAPLogonFilter and the initialization of WiredAutoConfig service or the WLANAutoConfig service ( responsible for Wired & Wireless 802.1x respectively )  while booting up,  PLAP logon filter is unable to identify the OneX credential providers properly & Pulse Credential provider is not notified about the same. This eventually results in Pulse Secure not loading the CP tile on Windows login screen.


 

As it's a limitation from Microsoft end, a technical support ticket has been lodged with Microsoft & currently work is in progress.

Once the investigation is done from Microsoft end this KB article would be updated with a workaround/solution.

When similar incidents are reported, Customers are advised to open a technical support ticket with Pulse Secure & get a confirmation on Root Cause.