Windows Registry

ISAC Desktop Client provides various options that users can use to enable or disable certain features of the client. The following is a list of options for WindowsOS:

Setting

Scenario

Configuration

Log size configuration

Location:
HKEY_LOCAL_MACHINE\SOFTWARE\Pulse Secure\Logging\LogSizeInMB

Control log file size for ISAC logging. Used for troubleshooting (increase size for more history) or control endpoint builds (decrease size to limit disk usage / log retention).

Set REG_DWORD

The default value is 50 MB and max can be configured as 200MB.

SAML window type

Location:

HKEY_LOCAL_MACHINE\SOFTWARE\Pulse Secure\Saml\SamlWindowType

Change how the SAML auth window is displayed. For example, classic window vs embedded vs system browser. This is used for troubleshooting SSO flows.

Set REG_DWORD

The default value is 0 and can be updated to 1 for small window size.

IgnoreEndpointProxy

Location:

HKEY_LOCAL_MACHINE\SOFTWARE\Pulse Secure\Pulse\IgnoreEndpointProxy

The IgnoreEndpointProxy registry controls whether ISAC should bypass local endpoint proxy settings when establishing VPN connections.

In enterprise environments, endpoints have proxy servers configured (via IE settings, GPO, PAC files). These proxies can interfere with VPN tunnel establishment, causing:

  • Connection failures during authentication

  • Slow connection establishment

  • Proxy authentication prompts during VPN setup

  • Split tunneling conflicts

This setting allows ISAC to ignore the endpoint's proxy configuration and connect directly to the VPN gateway.

Set REG_DWORD

 

Values:

  • 0 - Disabled (use endpoint proxy settings)

  • 1- Enabled (ignore endpoint proxy settings)

  • Not set- Feature not configured

TcpConnectTimeoutSeconds

Location:

HKEY_LOCAL_MACHINE\Software\Pulse Secure\TcpConnectTimeoutSeconds

Controls timeout and retry behavior for VPN tunnel connection establishment to Ivanti Secure gateway. Provides resilience against transient network failures during socket connect operations. Windows only (registry-based configuration).

Set REG_DWORD

 

Values:

  • TcpConnectTimeoutSeconds (default: 2)

    Socket connect() timeout in seconds before considering connection failed

  • TcpConnectRetries (default: 5)

    Maximum number of retry attempts on network failures (ENETUNREACH, EHOSTUNREACH, ENETDOWN, ETIMEDOUT)

  • TcpConnectRetryIntervalDelaySeconds (default: 2). Wait time in seconds between consecutive retry attempts

If registry values are not present, defaults are used.

UseSetInterfaceDnsSettings

Location:

HKEY_LOCAL_MACHINE\Software\Pulse Secure\UseSetInterfaceDnsSettings

Controls how Ivanti Secure configures DNS servers on your network adapters when connected to VPN. This setting allows you to switch between different Windows methods for managing DNS configuration.

The following DNS configuration issues seen when connecting to VPN:

  • DNS servers not applying correctly during VPN connection

  • DNS settings not restoring properly after VPN disconnection

  • Conflicts with other network management software

 

IPv6 DNS configuration always uses the modern Windows API regardless of this setting.

Set REG_DWORD

 

Values:

  • 0 (default) - Uses traditional WMI-based DNS configuration for IPv4

  • 1 - Uses modern Windows API for DNS configuration (recommended for Windows 10/11 and when experiencing DNS issues)

DNSRestoreLog

Location:

HKEY_LOCAL_MACHINE\Software\Pulse Secure\DNSRestoreLog

Controls diagnostic logging for DNS restoration operations

Automatically resets when file reaches 1MB to prevent disk space issues.

Values supported:

  • DNSRestoreNumTries - Controls retry attempts (default: 3)

  • DNSRestored - Internal flag tracking restoration status

Set REG_DWORD

 

Values:

  • 0 = disabled

  • 1 = enabled

When enabled, creates detailed logs at C:\Program Files(x86)\Pulse Secure\Logging\RestoreDNS.log

This is used to troubleshoot DNS restoration issues after VPN disconnects or system restarts

DNSRestoreNumTries

Location:

HKEY_LOCAL_MACHINE\Software\Pulse Secure\DNSRestoreNumTries

Controls number of time Ivanti Secure retries DNS configuration operations when connecting or disconnecting from VPN.

This setting is used in two scenarios:

  • During VPN connection - When configuring DNS servers on network adapters

  • During VPN disconnection - When restoring original DNS settings

Modify if:

DNS configuration frequently fails due to slow network adapter responses or system resource constraints

Keep default (3) for most environments as it handles typical transient failures

Each retry attempt waits 500 milliseconds before trying again. If all retry attempts fail during connection, the VPN connection will fail. This setting helps ensure reliable DNS configuration in environments where network adapter operations may be temporarily delayed."

Set REG_DWORD

 

Values:

  • 3 (default) - Retries DNS setup/restoration up to 3 times with 500ms delay between attempts

  • Custom value (1-10 recommended) - Customize retry count for DNS configuration operations

ESPParallelPacketProcessing

Location:

HKEY_CURRENT_USER\SOFTWARE\Pulse Secure\ESPParallelPacketProcessing

Controls whether incoming VPN data packets (ESP - Encapsulating Security Payload) are processed using multiple threads in parallel or sequentially affecting VPN download performance.

Modify if:

1. Leave at default (1) for optimal VPN download speeds in most environments

2. Set to 0 if experiencing reduced download performance when using OpenSSL FIPS mode, causing thread contention during encryption operations

This setting applies to Windows systems only. The parallel processing optimization improves VPN throughput by utilizing multiple CPU cores, but may be counterproductive in specific configurations involving FIPS-certified cryptographic modules.

Set REG_DWORD

 

Values:

  • 1 (default) - Parallel processing enabled. Uses multiple threads to process incoming VPN packets for better performance.

  • 0 - Parallel processing disabled. Processes VPN packets sequentially using a single thread.

DiscardADNSResponsesForSingleStackIPv6

Location:

HKEY_LOCAL_MACHINE\Software\Pulse Secure\DiscardADNSResponsesForSingleStackIPv6

Controls DNS response handling when your VPN connection uses IPv6-only while your local network uses IPv4.

This setting is only active when:

1. VPN tunnel is configured for IPv6-only (single-stack IPv6)

2. Your local network has IPv4 or dual-stack IP

3. DNS policy is set to Tunnel Only

Recommended: Default (1) unless experiencing specific IPv4/IPv6 DNS resolution issues or instructed by Ivanti Support to change it.

Set REG_DWORD

 

Values:

  • 1 (default) - Discards IPv4 DNS responses when VPN is IPv6-only. Prevents DNS resolution delays and conflicts between IPv4 local network and IPv6 VPN tunnel.

  • 0 - Allows IPv4 DNS responses even when VPN is IPv6-only. Can cause delays while applications wait for IPv4 responses that cannot be routed over the IPv6 VPN tunnel.

DNSMaxQueryAttemptsForARecord

Location:

HKEY_LOCAL_MACHINE\Software\Pulse Secure\DNSMaxQueryAttemptsForARecord

Controls number of times Ivanti Secure reuses the cached VPN gateway IP address from your last successful connection before performing a fresh DNS lookup.

Modify if:

  • Increase if experiencing DNS timeouts or slow DNS servers

  • Set to 0, if gateway uses load balancing or IP changes frequently

  • Keep default for most environments

Faster reconnection and improved reliability when DNS is slow or temporarily unavailable.

Set REG_DWORD

 

Values:

  • 2 (default) - Retries cached IP twice before fresh DNS lookup

  • 0 - Disables caching; always performs fresh DNS lookup

  • Custom (1-10) - Custom retry count before fresh lookup

PacketCapture


Location:
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Pulse Secure\Pulse\PacketCapture\Enabled

Used to capture packets. Currently, users install third party tools such as Wireshark, tcpdump etc to capture packets. Most endpoints are locked down restricting any application installation.

Configure the setting in ISAC desktop client:

  1. Select the Capture Packet option.

  2. In the Packet Capture Settings, select the Capture Type, Capture Duration, and Max Disk Space.

    The Clear Logs removes all data.

  3. Select Include Capture Packets in Logs to ensure the packet data is available in the logs for troubleshooting. During the packet capture, you can use back to navigate to the main page without disruption.

    To ensure packet data is captured, select packet capture in the Logs menu.

If VPN connection established after packet capture, then irrespective of the traffic type selected both tunneled and non-tunneled traffic is available. If VPN connection is disconnected during capture, irrespective of the selection only non-tunneled traffic information is collected.

The captured network traffic is in the pcap or pcapng format.

Set REG_DWORD

Values:

Enable / Disable

UiPromptTimeOutValue

Location:
HKEY_LOCAL_MACHINE\ SOFTWARE\WOW6432Node\Pulse Secure\Pulse\UiPromptTimeOutValue

Used to configure the Authentication timeout value for Smart Card authentication .

Configure the setting in Ivanti Connect Secure:

  1. Navigate to Users > User Realms > <Cert Realm Name> .

  2. Select the certificate created, select Authentication Policy >Certificate

  3. Select only allow users with a client-side certificate signed by Trusted Agent CA to sign in. To change the certificate authority , select Trusted Client CA page  > Override Certificate Challenge Timeout (default 1 minute).

 

Set REG_DWORD (32-bit)

Values:

Enter values in either Hexadecimal or decimal values.

Range: 120 – 240 seconds