This PowerShell script verifies Zscaler status by checking installation, required services, registry entries, and authentication via HTTP requests. It ensures Zscaler is operational and authenticated. For more details, visit Zscaler documentation and community links.

Test-ZscalerStatus.ps1

<#
.SYNOPSIS
This PowerShell script verifies the status of Zscaler by checking if it is installed, if the required services are running, if the necessary registry entries exist and have the correct values, and by making HTTP requests to verify Zscaler authentication.

.DESCRIPTION
The Test-ZscalerStatus function performs the following checks:
- If Zscaler is installed by querying the registry.
- If the required Zscaler services are installed and running.
- If the necessary registry entries exist and have the correct values.
- Makes HTTP requests to ip.zscaler.com to verify Zscaler authentication.

.PARAMETER Verbose
Switch to provide detailed output.

.EXAMPLE
Test-ZscalerStatus -Verbose
This command verifies the status of Zscaler and provides detailed output.

.INPUTS
None

.OUTPUTS
System.Boolean

.LINK
https://help.zscaler.com/zscaler-client-connector/zscaler-app-registry-keys
.LINK
https://help.zscaler.com/client-connector/what-is-zscaler-client-connector
.LINK
https://community.zscaler.com/s/question/0D54u00009evlSdCAI/detect-when-zpa-is-connected-using-powershell-and-wmi
.LINK
https://en.wikipedia.org/wiki/Zscaler
#>

# Arguments
param (
    [switch]$Verbose,
    [switch]$Debug
)

# Variables
$regPath = "HKCU:\Software\Zscaler\App"

# Lists/Arrays
$regPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall",
    "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall"
)

$requiredServices = @("ZSAService", "ZSATunnel")
$optionalServices = @("ZSATrayManager", "ZSAUpm")

$znwStateDescriptions = @{
    "TRUSTED_VPN" = "Connected to a trusted full tunnel VPN."
    "NON_TRUSTED" = "Connected to a non-trusted network."
    "TRUSTED" = "Connected to a trusted network."
}

$zpaStateDescriptions = @{
    "OFF" = "Service is turned off."
    "ON" = "Service is turned on."
    "CONNECTING" = "Service is connecting."
    "NONE_FORWARDING" = "Traffic interception is turned off."
    "TUNNEL_FORWARDING" = "Network drivers are intercepting traffic."
    "LOCAL_PROXY_FORWARDING" = "PAC files are intercepting traffic."
    "ENFORCE_PROXY_FORWARDING" = "A PAC file is enforced on the system."
    "ADAPTER_DOWN_ERROR" = "Adapter with a default route not found."
    "SERVICE_DOWN_ERROR" = "One of the microservices is not operational."
    "CAPTIVE_PORTAL_ERROR" = "Captive portal detected and open timeout expired."
    "SERVER_DOWN_ERROR" = "Unable to reach ZIA or ZPA Public Service Edge."
    "INTERNET_UNREACHABLE_ERROR" = "Network connected but ZPA can't resolve the broker name."
    "FIREWALL_BLOCK_ERROR" = "Outbound/inbound connection to itself failed."
    "SYSTEM_SOCKETS_EXHAUSTED_ERROR" = "System's limit for maximum sockets reached."
    "DRIVER_ERROR" = "Unable to load the network driver."
    "CAPTIVE_PORTAL_FAILOPEN" = "Captive portal detected, traffic interception stopped temporarily."
    "PRE_ENROLMENT_PROXY_ENFORCEMENT" = "Network access blocked until user logs in."
    "SERVER_AUTH_ERROR" = "Auth credentials not accepted by ZIA or ZPA Public Service Edge."
    "SERVER_AUTH_TERMINATED_AT_UNKNOWN" = "Realm mismatch between ZIA/ZPA Public Service Edge and logged-in user."
    "ZPA_UNTRUSTED_SERVER_CERT_ERROR" = "SSL exception while connecting to ZPA."
}

$zwsStateDescriptions = @{
    "OFF" = "Service is turned off."
    "ON" = "Service is turned on."
    "CONNECTING" = "Service is connecting."
    "NONE_FORWARDING" = "Traffic interception is turned off."
    "TUNNEL_FORWARDING" = "Network drivers are intercepting traffic."
    "LOCAL_PROXY_FORWARDING" = "PAC files are intercepting traffic."
    "ENFORCE_PROXY_FORWARDING" = "A PAC file is enforced on the system."
    "ADAPTER_DOWN_ERROR" = "Adapter with a default route not found."
    "SERVICE_DOWN_ERROR" = "One of the microservices is not operational."
    "CAPTIVE_PORTAL_ERROR" = "Captive portal detected and open timeout expired."
    "SERVER_DOWN_ERROR" = "Unable to reach ZIA or ZPA Public Service Edge."
    "INTERNET_UNREACHABLE_ERROR" = "Network connected but ZPA can't resolve the broker name."
    "FIREWALL_BLOCK_ERROR" = "Outbound/inbound connection to itself failed."
    "SYSTEM_SOCKETS_EXHAUSTED_ERROR" = "System's limit for maximum sockets reached."
    "DRIVER_ERROR" = "Unable to load the network driver."
    "CAPTIVE_PORTAL_FAILOPEN" = "Captive portal detected, traffic interception stopped temporarily."
    "PRE_ENROLMENT_PROXY_ENFORCEMENT" = "Network access blocked until user logs in."
    "SERVER_AUTH_ERROR" = "Auth credentials not accepted by ZIA or ZPA Public Service Edge."
    "SERVER_AUTH_TERMINATED_AT_UNKNOWN" = "Realm mismatch between ZIA/ZPA Public Service Edge and logged-in user."
    "ZPA_UNTRUSTED_SERVER_CERT_ERROR" = "SSL exception while connecting to ZPA."
}

# Function to check if a registry key exists
function Test-RegistryKeyExists {
    param (
        [string]$path
    )
    try {
        Write-Verbose "Checking if registry key exists: $path"
        $key = Get-Item -Path $path -ErrorAction Stop
        Write-Verbose "Registry key exists: $path"
        return $true
    } catch {
        Write-Warning "Registry key does not exist: $path"
        return $false
    }
}

# Function to check if a service is installed
function Test-ServiceExists {
    param (
        [string]$serviceName
    )
    try {
        Write-Verbose "Checking if service exists: $serviceName"
        $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue
        if ($service) {
            Write-Output "Service exists: $serviceName"
            return $true
        } else {
            Write-Warning "Service does not exist: $serviceName"
            return $false
        }
    } catch {
        Write-Error "Error checking service: $serviceName"
        return $false
    }
}

# Function to check if Zscaler is installed by querying the registry
function Test-ZscalerInstalled {
    foreach ($regPath in $regPaths) {
        Write-Verbose "Checking registry path: $regPath"
        $subKeys = Get-ChildItem -Path $regPath -ErrorAction SilentlyContinue
        foreach ($subKey in $subKeys) {
            $displayName = (Get-ItemProperty -Path $subKey.PSPath -Name DisplayName -ErrorAction SilentlyContinue).DisplayName
            if ($displayName -like "*Zscaler*") {
                Write-Output "Zscaler is installed."
                return $true
            }
        }
    }
    Write-Warning "Zscaler is not installed."
    return $false
}

# Function to retrieve the value of a registry entry
function Get-RegistryValue {
    param (
        [string]$path,
        [string]$name
    )
    try {
        Write-Verbose "Retrieving registry value: $path\$name"
        $value = Get-ItemProperty -Path $path -Name $name -ErrorAction Stop
        Write-Verbose "Retrieved registry value: $($value.$name)"
        return $value.$name.Trim()
    } catch {
        Write-Warning "Registry value not found: $path\$name"
        return "Not Found"
    }
}

# Function to retrieve the description of a state from a hashtable
function Get-StateDescription {
    param (
        [string]$state,
        [hashtable]$stateDescriptions
    )
    Write-Verbose "Retrieving state description for: $state"
    if ($stateDescriptions.ContainsKey($state)) {
        Write-Output "State description found: $state = $($stateDescriptions[$state])"
        return $stateDescriptions[$state]
    } else {
        Write-Warning "Unknown state: $state"
        return "Unknown state."
    }
}

# Function to get the status of a service
function Get-ServiceStatus {
    param (
        [string]$serviceName
    )
    try {
        Write-Verbose "Retrieving service status for: $serviceName"
        $service = Get-Service -Name $serviceName -ErrorAction Stop
        if ($service.Status -eq 'Running') {
            Write-Output "Service status: $serviceName = Running"
            return $true
        } else {
            Write-Warning "Service status: $serviceName = $($service.Status)"
            return $false
        }
    } catch {
        Write-Warning "Service not found: $serviceName"
        return $false
    }
}

# Function to check Zscaler authentication by making HTTP requests
function Test-ZscalerAuthentication {
    $url = "https://ip.zscaler.com/"
    $attempts = 5
    $interval = 10

    for ($i = 1; $i -le $attempts; $i++) {
        try {
            Write-Verbose "Attempt ${i}: Making HTTP request to $url"
            $response = Invoke-WebRequest -Uri $url -UseBasicParsing -MaximumRedirection 30 -TimeoutSec 60
            if ($response.StatusCode -eq 200 -and ($response.Content -match "You are accessing the Internet via Zscaler Cloud" -or $response.Content -match "Your request is arriving at this server from the IP address")) {
                Write-Verbose "Zscaler authentication successful."
                return $true
            } else {
                Write-Warning "Zscaler authentication failed on attempt $i."
            }
        } catch {
            Write-Warning "HTTP request failed on attempt $i."
        }
        Start-Sleep -Seconds ($interval * $i)
    }
    return $false
}

# Main function to verify the status of Zscaler
function Test-ZscalerStatus {
    # Set VerbosePreference to ensure verbose messages are displayed
    $originalVerbosePreference = $VerbosePreference
    if ($Verbose) {
        $VerbosePreference = 'Continue'
    }

    # Check if Zscaler is installed by querying the registry
    $zscalerInstalled = Test-ZscalerInstalled

    # Check if any Zscaler services are installed
    $servicesInstalled = $false
    foreach ($serviceName in $requiredServices + $optionalServices) {
        if (Test-ServiceExists -serviceName $serviceName) {
            $servicesInstalled = $true
            break
        }
    }

    # Check required services
    $allServicesRunning = $true
    $serviceStatuses = @()
    foreach ($serviceName in $requiredServices) {
        $status = Get-ServiceStatus -serviceName $serviceName
        $serviceStatuses += "${serviceName}: $status"
        Write-Verbose "Service status: $serviceName = $status"
        if ($status -notcontains "Running") {
            $allServicesRunning = $false
        }
    }

    # Check registry entries
    $znwState = (Get-RegistryValue -path $regPath -name "ZNW_State").Trim()
    $znwStateDescription = Get-StateDescription -state $znwState -stateDescriptions $znwStateDescriptions

    $zpaState = (Get-RegistryValue -path $regPath -name "ZPA_State").Trim()
    $zpaStateDescription = Get-StateDescription -state $zpaState -stateDescriptions $zpaStateDescriptions

    $zwsState = (Get-RegistryValue -path $regPath -name "ZWS_State").Trim()
    $zwsStateDescription = Get-StateDescription -state $zwsState -stateDescriptions $zwsStateDescriptions

    $zpaAuthState = (Get-RegistryValue -path $regPath -name "ZPAAuth_State").Trim()
    if ($zpaAuthState -ne "AUTHENTICATED") {
        Write-Warning "ZPAAuth_State is not AUTHENTICATED or does not exist. Zscaler is not authenticated."
        return $false
    }

    $zpaStateValid = $zpaState -eq "TUNNEL_FORWARDING"
    $zwsStateValid = $zwsState -eq "TUNNEL_FORWARDING"

    # Determine overall status
    $isZscalerOperational = $zpaStateValid -and $zwsStateValid -and $allServicesRunning

    # Check Zscaler authentication
    #$zscalerAuthenticated = Test-ZscalerAuthentication

    # Log detailed status messages
    Write-Verbose "ZNW_State (Zscaler Network State): $znwState - $znwStateDescription"
    Write-Verbose "ZPA_State (Zscaler Private Access State): $zpaState - $zpaStateDescription"
    Write-Verbose "ZWS_State (Zscaler Internet Access State): $zwsState - $zwsStateDescription"
    Write-Verbose "Services:"
    foreach ($serviceStatus in $serviceStatuses) {
        Write-Verbose $serviceStatus
    }
    foreach ($serviceName in $optionalServices) {
        $status = Get-ServiceStatus -serviceName $serviceName
        Write-Verbose "${serviceName}: $status"
    }

    if ($zscalerInstalled) {
        Write-Verbose "Zscaler is installed."
    } else {
        Write-Warning "Zscaler is not installed."
    }

    if ($servicesInstalled) {
        Write-Verbose "Zscaler services are installed."
    } else {
        Write-Warning "Zscaler services are not installed."
    }

    if ($allServicesRunning) {
        Write-Verbose "Zscaler required services are running."
    } else {
        Write-Warning "Zscaler required services are not fully running."
    }

    if ($zpaStateValid -and $zwsStateValid -and $allServicesRunning) {
        Write-Verbose "Zscaler is authenticated and forwarding traffic."
    } else {
        Write-Warning " zsaStateValid: $zpaStateValid zwsStateValid: $zwsStateValid allServicesRunning: $allServicesRunning"
        Write-Warning "Zscaler is not authenticated or not forwarding traffic."
    }

    Write-Verbose "Overall Zscaler status: $isZscalerOperational"

    # Restore original verbose preference
    $VerbosePreference = $originalVerbosePreference

    #return $isZscalerOperational -and $zscalerAuthenticated
    return $isZscalerOperational
}

# Run the Test-ZscalerStatus function
Test-ZscalerStatus

Test-ZscalerStatus.ps1

This PowerShell script verifies the operational status of Zscaler by checking its installation, required services, registry entries, and authentication via HTTP requests. It ensures Zscaler is installed, services are running, registry entries are correct, and authentication is successful.

Usage

.\Test-ZscalerStatus.ps1 [options]

Options

• -Verbose: Enables verbose logging for detailed output.

Running the Script from the Internet:

Use Invoke-RestMethod to download and execute the script. Here is how you can do it:

# Using Invoke-RestMethod
irm https://gist.githubusercontent.com/emilwojcik93/6c2c3b26eaf46042645d90784fd1b907/raw/ed3e2caab0a2008860a908a449f6e0c3858ca6c3/Test-ZscalerStatus.ps1 | iex

Short URL

• Is there a permalink to the latest version of gist files?
• How to permalink to a gist's raw file

# Using Invoke-RestMethod
irm https://gist.githubusercontent.com/emilwojcik93/6c2c3b26eaf46042645d90784fd1b907/raw | iex

# Using Invoke-RestMethod
irm https://gist.github.com/emilwojcik93/6c2c3b26eaf46042645d90784fd1b907/raw | iex

Note

If it doesn't work, then try to Set-ExecutionPolicy via PowerShell (Admin)

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force; irm https://gist.githubusercontent.com/emilwojcik93/6c2c3b26eaf46042645d90784fd1b907/raw/ed3e2caab0a2008860a908a449f6e0c3858ca6c3/Test-ZscalerStatus.ps1 | iex

Note

To execute the script from the Internet with additional parameters, please run

&([ScriptBlock]::Create((irm https://gist.githubusercontent.com/emilwojcik93/6c2c3b26eaf46042645d90784fd1b907/raw/ed3e2caab0a2008860a908a449f6e0c3858ca6c3/Test-ZscalerStatus.ps1))) -Verbose

Example of execution

PS > irm https://gist.githubusercontent.com/emilwojcik93/6c2c3b26eaf46042645d90784fd1b907/raw/ed3e2caab0a2008860a908a449f6e0c3858ca6c3/Test-ZscalerStatus.ps1 | iex
True
PS > &([ScriptBlock]::Create((irm https://gist.githubusercontent.com/emilwojcik93/6c2c3b26eaf46042645d90784fd1b907/raw/ed3e2caab0a2008860a908a449f6e0c3858ca6c3/Test-ZscalerStatus.ps1))) -Verbose
VERBOSE: Checking registry path: HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall
VERBOSE: Checking if service exists: ZSAService
VERBOSE: Retrieving service status for: ZSAService
VERBOSE: Service status: ZSAService = Service status: ZSAService = Running True
VERBOSE: Retrieving service status for: ZSATunnel
VERBOSE: Service status: ZSATunnel = Service status: ZSATunnel = Running True
VERBOSE: Retrieving registry value: HKCU:\Software\Zscaler\App\ZNW_State
VERBOSE: Retrieved registry value: TRUSTED
VERBOSE: Retrieving state description for: TRUSTED
VERBOSE: Retrieving registry value: HKCU:\Software\Zscaler\App\ZPA_State
VERBOSE: Retrieved registry value: TUNNEL_FORWARDING
VERBOSE: Retrieving state description for: TUNNEL_FORWARDING
VERBOSE: Retrieving registry value: HKCU:\Software\Zscaler\App\ZWS_State
VERBOSE: Retrieved registry value: TUNNEL_FORWARDING
VERBOSE: Retrieving state description for: TUNNEL_FORWARDING
VERBOSE: Retrieving registry value: HKCU:\Software\Zscaler\App\ZPAAuth_State
VERBOSE: Retrieved registry value: AUTHENTICATED
VERBOSE: ZNW_State (Zscaler Network State): TRUSTED - State description found: TRUSTED = Connected to a trusted network. Connected to a trusted network.
VERBOSE: ZPA_State (Zscaler Private Access State): TUNNEL_FORWARDING - State description found: TUNNEL_FORWARDING = Network drivers are intercepting traffic. Network drivers are intercepting traffic.
VERBOSE: ZWS_State (Zscaler Internet Access State): TUNNEL_FORWARDING - State description found: TUNNEL_FORWARDING = Network drivers are intercepting traffic. Network drivers are intercepting traffic.
VERBOSE: Services:
VERBOSE: ZSAService: Service status: ZSAService = Running True
VERBOSE: ZSATunnel: Service status: ZSATunnel = Running True
VERBOSE: Retrieving service status for: ZSATrayManager
VERBOSE: ZSATrayManager: Service status: ZSATrayManager = Running True
VERBOSE: Retrieving service status for: ZSAUpm
VERBOSE: ZSAUpm: Service status: ZSAUpm = Running True
VERBOSE: Zscaler is installed.
VERBOSE: Zscaler services are installed.
VERBOSE: Zscaler required services are running.
VERBOSE: Zscaler is authenticated and forwarding traffic.
VERBOSE: Overall Zscaler status: True
True

Links

• Zscaler Client Connector Registry Keys
• What is Zscaler Client Connector
• Detect when ZPA is connected using PowerShell and WMI
• Zscaler on Wikipedia