Nicely done! This should be a good reminder to everyone who utilizes a pre-logon VPN to treat that environment as if it were already compromised. I've set up a

Nicely done! This should be a good reminder to everyone who utilizes a pre-logon VPN to treat that environment as if it were already compromised. I've set up a ton of these, and never in my wildest nightmares would I give the pre-logon user access to anything they could use to move laterally in the org. For those who aren't familiar with this, (for Palo Alto at least) there is a specific user assigned to pre-logon tunnels, and that user is supposed to be locked down - tight. Once a user authenticates fully to AD/okta/whatever, then the userID on the tunnel is swapped for the correct one, and your permissions become what they should be. Worth nothing that this is set up with firewall rules based on LDAP/AD user groups/UserIDs, so it's easy to configure, but probably easy to make mistakes.