Disabling Global Secure Access By Registry
Query
DeviceRegistryEvents
| where ActionType == "RegistryValueSet" //or ActionType == "RegistryKeyCreated"
| where RegistryKey == @"HKEY_CURRENT_USER\Software\Microsoft\Global Secure Access Client"
| where RegistryValueName == "IsPrivateAccessDisabledByUser"
| where RegistryValueData == "1" ///If the registry value doesn't exist, the default value is 0x0, Private Access is enabled. https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-windows-client#disable-or-enable-private-access-on-the-client?WT.mc_id=MVP_473477Explanation
This query is searching through device registry events to find specific actions related to the Windows registry. Here's a simple breakdown:
- Event Type: It looks for events where a registry value is set or a registry key is created.
- Registry Key: It specifically checks the registry key located at
HKEY_CURRENT_USER\Software\Microsoft\Global Secure Access Client. - Registry Value Name: It focuses on the registry value named
IsPrivateAccessDisabledByUser. - Registry Value Data: It filters for cases where this registry value is set to "1".
In essence, this query identifies instances where a user has disabled "Private Access" in the Global Secure Access Client settings on their Windows device. If this registry value is set to "1", it indicates that the user has manually disabled this feature.
Details
Jay Kerai
Released: October 3, 2025
Tables
DeviceRegistryEvents
Keywords
DeviceRegistryEventsGlobalSecureAccessClient
Operators
DeviceRegistryEvents|where==//or///