globalprotect agent install failing on windows 11

TL;DR

Most GlobalProtect install failures on Windows 11 come from a conflicting VPN client, missing admin rights, or the installer being blocked by SmartScreen or endpoint protection. Uninstall other VPN clients, run the MSI as administrator from an elevated prompt, and check the MSI log for the exact failure. The log names the failing custom action; everything else is guessing.

The error

Installation failed. The wizard was interrupted before GlobalProtect could be installed.

MSI log: "Return value 3" marking the failing action

Steps

1. Run the installer as an administrator: right-click the MSI > Run as administrator, or launch from an elevated command prompt. Expected: UAC prompts for elevation. Silent pushes via Intune or SCCM already run elevated; manual installs often do not.
2. Uninstall any other VPN clients (AnyConnect, FortiClient, old GlobalProtect versions). Expected: only one VPN client remains. Competing virtual adapters and filter drivers are the top cause of rollbacks.
3. Temporarily pause third-party antivirus or EDR during the install if policy allows. Expected: the installer proceeds past driver installation. Endpoint protection quarantining the virtual adapter driver is a classic failure.
4. Run the MSI with logging from an elevated prompt: msiexec /i GlobalProtect64.msi /l*v gpinstall.log. Expected: a log file appears; search for "Return value 3" to find the failing step.
5. Check Windows 11 specifics: Secure Boot and HVCI (memory integrity) can block old drivers; update to the GlobalProtect version your org certifies for Windows 11. Expected: the installer completes on the supported version.
6. After a successful install, reboot and confirm the GlobalProtect service is running and the portal address is pre-populated. Expected: the agent shows "Not connected" (ready), not an error.

Use this when

• The GlobalProtect MSI fails, rolls back, or shows "installation interrupted"
• Upgrading GlobalProtect on Windows 11 fails
• Mass deployment via Intune or SCCM reports install failures

Not for this skill when

• GlobalProtect installs fine but cannot connect to the portal (a connection issue, not an install issue)
• macOS GlobalProtect install problems (different installer, different failures)
• The portal or gateway config is wrong (server side, not the agent)

Compatibility

• GlobalProtect agent 6.x on Windows 11 (21H2 and later); MSI-based install

Variants

"A newer version is already installed"

The uninstaller left registry residue. Use the GlobalProtect clean-uninstall tool or remove the leftover program entry, then reinstall.

Install succeeds but the agent never starts

The PanGPS service failed to start; check Windows Services for disabled dependencies or a group policy blocking new services.

Why it happens

The installer does three risky things: installs a virtual network adapter driver, registers filter drivers, and writes machine-level config. Any of these can collide with another VPN client, get blocked by security software, or fail driver signing checks. The MSI log pinpoints which one; the steps fix them in likelihood order.

Edge cases

• ARM64 Windows 11 needs the ARM64 GlobalProtect build; the x64 MSI fails on it.
• Disk encryption or pending Windows updates requiring a reboot can interrupt installs; reboot first, then install.
• A wrong portal address baked into the MSI does not fail the install; it fails the first connection.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst2xnUwAE3oYy_zGydHBKSQ