Disconnected due to change in routing table

[CaseyH_]

I have a client using Windows 7 that can't stay connected to Pulse.

I found in the logs that 2-4 seconds after connecting, the route table is being changed and thus Pulse disconnects.

I could use some assistance in finding WHAT is changing the routing table and causing the issue.

I read through some of the older issues with Vista and XP to see if anything was of use.

I saw references to Bonjour changing the table, but this machine does not have that installed.

The error log entry (with me noting out specifics):

The connection VPN (myvpn.com) (ID 53c7860f-66e1-41a8-910b-940f39885a95) was disconnected due to change in routing table. Interface address changed from 192.168.1.2 to 0x0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

is there a way to capture what's making a change?

[CaseyH_]

I found this old thread and we tried to change the metric in Windows 7, but it wouldn't stick. It kept reverting to being checked.
https://forums.pulsesecure.net/topic/pulse-connect-secure/41163-mac-os-106-network-connect-wireless-...

[zanyterp]

Is there another VPN installed?
Is there an AV/FW/AS/et cetera that would/could track changes to the network and block access/revert any changes?
What does your system events log show around the time of failure?
What version of Pulse is being used?
Is VMware installed? If yes, is it actively being used?
Are you able to disable the route monitor on the VPN tunneling configuration?

[zanyterp]

I think MS makes a tool that allows monitoring at the NIC level but I can't think of it or find it right now; if I come up with it, I will post later.

[kita]

I believe I've used this one in the past: http://www.nirsoft.net/utils/network_route_view.html