Prisma Access Agent Intermittent Disconnection Caused by Duplicate Host ID on Cloned Endpoints

Prisma Access Agent Intermittent Disconnection Caused by Duplicate Host ID on Cloned Endpoints

485
Created On 07/20/26 20:11 PM - Last Modified 08/14/26 02:44 AM


Symptom


  • Prisma Access Agent unexpectedly disconnects without any user- or admin-initiated logout action.
  • After disconnection, the Prisma Access Agent UI remains in a Disconnected state with no SAML authentication pop-up or browser redirect appearing.
  • When a second cloned endpoint disconnects, both endpoints simultaneously receive a re-authentication prompt, disrupting connectivity for all affected users.

Environment


  • Prisma Access Agent (PAA)
  • Endpoint Policy Manager (EPM) — Agent Configuration
  • Windows endpoints (cloned or imaged)

Cause


  • When two or more Windows endpoints are cloned from the same image, they share an identical Host ID (Windows Machine GUID).
  • The Endpoint Policy Manager (EPM) enforces a one-client-per-Host-ID policy.
  •  When a duplicate Host ID is detected, the EPM sends a logout command to the extra client(s) to ensure only one client with that Host ID remains connected.
  • This forced logout is received by the Prisma Access Agent as a standard EPM sign-out command, triggering tunnel disconnection.
  • The affected client's Prisma Access Agent logs show the EPM logout command arriving over the WebSocket without any administrator action, followed immediately by credential deletion and IPsec tunnel teardown.
  • The PAA is working as designed here. 

Resolution


  1. Identify all endpoints sharing the same Host ID by reviewing PAA logs (pacli_emp_status.log) or gateway logs for duplicate Host ID entries.
  2. On each affected Windows endpoint (except the original), open an elevated PowerShell prompt.
  3. Generate a new unique Machine GUID using SYSPREP: run sysprep /generalize to reset the Machine GUID. Note: SYSPREP will require a reboot and may reset Windows activation — plan accordingly.
  4. Note:- Please refer to Microsoft official documentation and run sysprep after consultation with the local IT team. The above commands are for reference only. 
  5. Alternatively, update the registry key directly: Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Cryptography" -Name MachineGuid -Value (New-Guid).Guid then restart the endpoint.
  6. Verify that each endpoint now has a unique Host ID before reconnecting to Prisma Access.
  7. Re-enroll or reconnect the Prisma Access Agent on the affected endpoints to confirm stable connectivity.

Additional Information


  • This issue is commonly encountered in virtual desktop infrastructure (VDI) environments or when endpoints are provisioned from a golden image without running SYSPREP first.
  • Ensure that any cloning or imaging workflow includes a SYSPREP generalize step to guarantee unique Machine GUIDs across all deployed endpoints
  • Check PAS.log  logs to identify the issue. Example below

     

  • 2026-08-11T09:24:18.312+05:30 <info> SB004829 [4120:7312] API response indicates that the token is not valid. 
2026-08-11T09:24:18.312+05:30 <debug> SB004829 [4120:5104] Disconnect gateway due to error event - 
252026-08-11T09:24:18.312+05:30 <info> SB004829 [4120:7312] Recording new epm error: Token Collision: User needs to re-enroll.
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000wlhNKAQ&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail