How to upgrade the Terminal Server Agent and enable support for WFP driver

This article lists the steps to upgrade the Terminal Server Agent to version 11.1.0 which introduces support for Microsoft WFP driver.

High-level steps

Back up the Terminal Server Agent configuration

Uninstall the old version of Terminal Server Agent

Reboot the server

Install the new Terminal Server Agent

Verify installation

• Palo Alto Firewall
• Terminal Server Agent versions below 11.1.0

1. Back up the Terminal Server Agent configuration
   1. On your Windows server, navigate to “C:\Program Files\Palo Alto Networks\Terminal Server Agent”.
   2. Create a compressed archive of the contents of this folder and save the archive to a different location.
2. Click the “Exit” button to close the Terminal Server Agent application

3. Open the Services application on your Windows server.
4. Locate the service named “PAN Terminal Server Agent”. Right-click the service and select “Stop” as shown in the screenshot below.

5. Uninstall the Terminal Server Agent

6. Reboot the server

7. Download the Terminal Server Agent installation file from the Customer Support Portal
8. Install the Terminal Server Agent
   1. Open the Windows Start menu, right-click the Command Prompt program, and select “Run as Administrator”.
   2. From the command line, run the file you downloaded. For example, if you saved the file to the Desktop, enter the following:

   3. C:\Users\administrator.acme>cd Desktop 
      C:\Users\administrator.acme\Desktop>TaInstall<version>.msi

   4. Follow the setup prompts to install the agent using the default settings. The setup installs the agent in “C:\Program Files\Palo Alto Networks\Terminal Server Agent”.
   5. During installation you will see the pop-up window shown in the screenshot, which reminds you to perform the backup at step 1 above. Click “Yes”.
   6. When the installation completes, click “Close”.

9. .Restore custom certificates from the backup
   1. From the backup you took at step 1, extract any custom certificate files you had configured through the “Server Certificates” option in the UI. Skip this step if you do not have custom certificates configured.
10. Start the Terminal Server Agent
    1. From the Windows Start menu, open the Terminal Server Agent application.
    2. Open the Services application and confirm that the PAN Terminal Server Agent service is running

11. Verify installation in n the Terminal Server Agent application UI, open File > Show Logs.

1. 1. The following log messages will be displayed:

      09/03/25 10:52:41[Info   293]: Service version is 11.1.0.1.

      09/03/25 10:52:41[Info   297]: Installed driver version is 7.0.0.1.

      09/03/25 10:52:42[Info   101]: Running driver version is 7.0.0.1.

      09/03/25 10:52:42[Info  1032]: [1] Drv[739]: WFP init successful

       

Configure the Palo Alto Networks Terminal Server (TS) Agent for User Mapping