Secure connect keeps popping up or stealing focus repeatedly

[anfare]

Running Window 10 fully patched and I've installed Secure Client on a bunch of our users machines. Things seems to work for the most part, but there is an annoying behavior that I can't seem to find the cause of. Randomly, multiple times a day, the Secure Client window will open up and steal focus from whatever the user is doing (and the icon in the taskbar will glow orange). The Secure client will be running in the system tray, so it is already open. The users are all already on the local LAN and do not need to use the VPN. But it is annoying for them to have this pop up and have to minimize it over and over again (and can be even more confusing for the less tech-savvy users). 

The Secure client options are set as such:

[ ] Start VPN when Cisco Secure Client is started

[X] Minimize Cisco Secure connect on VPN connect

[X] Allow local LAN access

[ ] Disable Captive portal detection

[X] Block connections to untrusted servers

Secure client versions:

AnyConnect VPN 5.1.1.42

Customer Experience feedback 5.1.1.42

DART 5.1.1.42

Secure client UI 5.1.0.1047

Secure Firewall Posture 5.1.1.42

Thousand eyes 1.189.1

Umbrella 5.1.1.42

I've also tried removing Cisco Secure Connect client interface from the Startup apps.

Any idea what could be causing this and if there is anything I can do to stop it?

Thanks.

[BlakeBratu]

Are you using trusted network detection?

[anfare]

Thanks for the reply. I do not see that option anywhere so I don't think so? Mind you, this is all of the time; even when on the local network and not using the VPN. 

[BlakeBratu]

Sorry for the delay in getting back to you. It has been a bit busy on my end as we wrap up April!

I've been taking a look at similar issues encountered by other customers. It might be fruitful to generate a DART and send it to me through a private message with a timestamp of when the pop-up window appears. I can see if I can spot any behavior that would trigger AnyConnect/Cisco Secure Client to pop up. I can share the solution here if we're able to identify one.

[anfare]

Thanks, message sent with bundle. 

[tom-bence]

@anfare Was there any progress on this one? I've just started using the Cisco Secure Client and some users are reporting the same behaviour, the application keeps opening up sporadically and taking focus.

[BlakeBratu]

Hi @tom-bence , I've been researching and it looks like it may be because Secure Client is probing the head-end for captive portal detection. There were also reports of Umbrella attempting to probe the head-end which resulted in the Secure Client GUI popping up sporadically. I would still have to research.

You could try disabling captive portal detection on a computer basis in the AnyConnect/Secure Client GUI under Preferences and see if this solves the problem just as a test.

[tom-bence]

Hi Blake, 

 Thanks for the advice, if you can provide any links to how to do this I will make a note of them and review in due course. It seems the issue has gone away of it's own accord at the moment, so I'm reluctant change anything unless I get anymore reports. As it stands, I had two user report the issue originally. 
When speaking to my contact in presales support, they did recommend this, believing it was the AnyConnect module causing it: 
https://support.umbrella.com/hc/en-us/articles/18211951038740-How-to-disable-the-VPN-module-in-Cisco-Secure-Client

However, I have not tried it yet. As I say, the issues appears to have dissipate of it's own accord. 

Thanks,
Tom

[BlakeBratu]

Hi @tom-bence, no problem.  Unfortunately with this issue, the most I can do is speculate out without digging into the grittiness of logs and DART bundles.

You'll want to head into the Secure Client/AnyConnect GUI, click the settings cog icon and head on over to preferences. You'll see the option:

If anyone else encounters the issue, let me know if this yields any fruitful results. I've seen this option work according to internal research. I have yet to reproduce or try in my own lab environment. I'll tinker around and see.