It’s some kind of locked-down version of GlobalProtect that’s integrated with a TPM module to prevent machines that aren’t running our corporate image on corporate-approved laptops from being able to connect.

There’s probably some kind of workaround, but I’m lazy and it’s easier just to power up the Windows machine now and then.