Remote Access Software Download Center

Cisco AnyConnect Sign-on Before Login (SBL) Components

Windows XP

Some employees require/prefer the ability to connect to the VPN before logging in to their Corporate Laptop so all their mapped drives will be there upon login. In order to activate this feature, you must add the optional Cisco AnyConnect Sign-on Before Login (SBL) Components. You can enable or disable this feature once installed by going into the prefrences on the AnyConnect client login screen.

 ***NOTE: Pre-Logon is NOT available on the Mac platform.

Windows Pre-Login API's

  • Windows XP : GINA: Graphical Identification aNd Authentication

  • Windows 7: PLAP: Pre-Logon Authentication Provider.

Please note the following: SBL behaves much differently on Windows XP than it does on Windows 7. This is because the differences in technology between the XP and Windows 7 Pre-Login API's. For that reason, there are different pages for installing SBL on Windows 7 and XP. If you are looing for the Windows 7 Instructions, please click here.


  • You should already have your AnyConnect VPN Client installed using the instructions located on the previous page.
  • You can already connect to the VPN with your account.
  • You should understand that you cannot access your RSA SecurID Software Token during the Pre-Logon phase if it is installed on your laptop. If you want to use the SBL Components, you must have one of the following:
    • An RSA SecurID Keyfob Token
    • An RSA SecurID software Token on your Corporate Blackberry or Apple IOS Device (iPhone, iPad)


If you do not have a token please contact the Enterprise IT Help Desk for assistance. 516-803-HELP (4357)

Installing the AnyConnect SBL Components

Detailed Installation Instructions

  1. Download the AnyConnect SBL Components here, you will be prompted to Run or Save the file. Please Click 'Save' and then save it to your desktop, and then save the file to your desktop as seen in the images below.



2. Locate the file on your desktop, and double-click on it to begin the installation.



3. Click Next, then click Install.



4. It should be a very quick installation. Please click Finish when completed. You will then be prompted to re-boot your machine. Please click 'Yes' to restart your system.




Enabling SBL

Now that you have installed the SBL Components, you need to enable the SBL Feature. To do you you need to login to the VPN manually, click on 'Preferences' on the Anyconnect Client, and check the 'Use Start Before Logon' check box to enable the feature for future logon's.


1. Assuming your last step was to reboot the machine after installing the SBL Components, please login to your machine.


2. Once logged in, please launch the Cisco AnyConnect VPN Client.


3. Now login to the VPN.


4. Once Connected, please click on the VPN icon in the lower right hand corner of the screen to bring up the client window.


5. On the 'Connection' tab, please click the preferences button as shown below and then click the check next to: 'Use Start Before Logon' . Then click OK. From now on, every time you login to the machine, you will be given the option to connect to the VPN first.



Logging in with SBL

1. When you start your machine, you should see the screen as seen in the image below prompting you to 'Press CTRL + ALT + DEL to log on'. Please press CTRL +ALT + DEL.



2. Instead of seeing the normal 'Logon Screen', the Cisco AnyConnect Client screen should be presented. Please connect to as you would normally. As mentioned previously - you cannot access an RSA SecurID Software Token installed on the same machine during this 'Pre-Boot' phase. You MUST have an external device to generate your 'Passcode' such as a Keyfob (Hard) Token, or a soft token on your corporate smartphone.  *** NOTE: If you don't want to connect to the VPN, you always have the option of clicking on the 'X' in the upper right hand corner of the client and not logging in to the VPN.


3. You should now see your normal login screen. Please login as you would if you were at your desk, plugged into the LAN.



4. Once logged in, you are ready to work. If you check 'My computer', you should see all your mapped corporate drives.