Active Directory with Netskope Adapters - Netskope Technical Documentation

The Netskope Adapter provides key integrations to enable seamless synchronization of user data and enhance visibility in the Netskope platform.

It supports the following functionalities:

Directory Importer: Connects to a domain controller (DC) and periodically fetches user and group information from the DC, and posts that information to your tenant instance in the Netskope cloud. If you are using the Netskope Client and Data Plane On-Premises (DPoP) you can utilize user.
AD Connector: Connects to the DC and periodically fetches user login events, extracts the User to IP mapping, and posts that info to DPoP and On-Premises Log Parser (OPLP). This provides user visibility for traffic going through DPoP and OPLP.

Depending on your needs, the NSAdapters.msi file can install either or both components on a single machine. In addition, it installs a Configuration Utility UI that allows you configure the needed parameters to use different features.

Netskope Adapters integrate with your Active Directory (AD) server to retrieve the IP address to User mapping and use that information to provide user visibility for log processing. Visibility into cloud app usage at a user level helps to align application usage with business unit requirements. The Netskope Adapters enable running various features that can integrate with your AD and other directory servers to collect user and user activity information. This helps you to collect analytics and enforce policies.

If you are using only the On-Premises Log Parser (OPLP) Virtual Appliance (VA), the only feature required to get user visibility is AD Connector.

Supported Platforms

The Netskope Adapters work on these platforms:

Windows 11
Windows 10 64-bit
Windows 2016
Windows Server 2019
Windows Server 2022
Windows Server 2025

Prerequisites

Using the Netskope Adapters have these requirements:

Download the Netskope Adapter file (NSAdapters.msi). To download, log into your Netskope tenant, go to Settings > Tools > Directory Tools and click Download Tools.
The machine running Netskope Adapters must be a part of the domain and not necessarily run on the Domain Controller (DC).
Ensure that Microsoft .NET Framework 4.8 or later (Supports TLS 1.2) is installed on this server.
Create a new account with Log on as a service rights for a local machine in the domain to be used for Netskope Adapters. Netskope recommends creating a dedicated service account or user with admin rights in the AD domain.
Local admin privileges are required to install the Netskope Adapter. You can log in with your own username to perform the installation if you are the local admin on the system. Directory Importer requires local admin privileges as well. Refer to Permissions for Directory Importer below for more details.
The user installing Netskope Adapters must be a member of the domain.
All services are installed under the provided username that has Log on as a service rights for the local machine.

DNS Connector is no longer supported. See here for EoL announcement.

Permission Requirements for Directory Importer, AD Connector

Directory Importer

AD Connector

If Directory Importer fetches users from a non-Microsoft LDAP server, the user account specified during its installation should be an account on the local machine with administrator privileges. The user account specified in the Directory Attributes dialog box (under Other Directory Services) must be part of the Domain.

Account Privileges
- Installation Privileges
  - Local admin privileges – The username specified during installation can be different from the currently logged-on user. An administrator can be logged in with a different username to perform the installation. In this case, both logged-on user and the user specified during installation require local admin privileges.
  - Service Account (with read/write access) – For reading and writing into the config directory (default: c:\program files\netskope directory) and log files.
- Operational Privileges
  
  Non-admin user account – For general operation / execution of Directory Importer. Directory Importer will run as expected. The user must be an authenticated account of the Domain.
Requires port 443 connectivity to addon-<tenant-URL>

To test if the Directory Importer can run with the current user privileges, enter the following command at the command prompt.
```
dsquery user domainroot -name * -u <username> -p <password>
```

If the user has privileges, the command will execute without an error. Following is an representational example of a successful output , but the actual content or output may vary depending on your environment.

C:Users>dsquery user domainroot -name * -u  username1 -p 123456789
"CN=Administrator,CN=Users,DC=exampledomain,DC=local"
"CN=Guest,CN=Users,DC=exampledomain,DC=local"
"CN=Guest2,CN=Users,DC=exampledomain,DC=local"
"CN=username1,OU=UserInfoDistOU1,DC=exampledomain,DC=local"
"CN=username2,OU=UserInfoDistOU1,DC=exampledomain,DC=local"
"CN=username3,OU=UserInfoDistOU2,DC=exampledomain,DC=local"
"CN=user.exampleorg1.test,OU=exampleorg,DC=exampledomain,DC=local"
"CN=user.exampleorg2.test,OU=exampleorg,DC=exampledomain,DC=local"
"CN=user.exampleorg3.test,OU=exampleorg,DC=exampledomain,DC=local"

AD Connector requires these permissions:

A user should have appropriate privilege to read the AD security event logs.
A user must be added to the built-in AD group Event Log Readers. The path to add is Start > Administrative Tools > Active Directory Users and Computers > Users > User > Properties > Member Of.
Ensure specific Windows Firewall rules are enabled. On the AD server, go to Start > Administrative Tools > Windows Firewall with Advance Security.
For the Inbound rules, enable the rules for Remote Event Log Management for the following options:
- Remote Event Log Management (NP-In)
- Remote Service Management (RPC)
- Remote Service Management (RPC-EPMAP).

Optionally, for additional security, you also allow incoming connections only from the IP of the remote machine designated to gather the event logs. You can enter this setting in the Rule Properties.

Netskope Adapter Release and Version

Starting with version 120.0.0, Netskope Adapter releases are decoupled from the Netskope Cloud release. Netskope provides quarterly releases of the Directory Tools (previously known as the AD Adapter), which consists of Director Importer (previously known as AD Importer) and AD Connector.

The Directory Tool that is part of the Netskope Adapter follows the format: major.minor.build_number.revision_number.

For example: 215.255.20261.23

Major: Indicates the number that gets updated only when there is a significant change in the product design.
Minor: Indicates the minor version of the release number. This is automatically incremented during each release.
Build_Number: Indicates the build number of the release. Build number is derived from date which represent year and quarter. For example, the build number for the the first quarter of 2026 will be 20261.
Revision_Number: Indicates the number of commits since the last release.

Backward Compatibility

A quarterly major release is backward compatible using the ‘n-2’ principle. This gives nine months for administrators to move to a supported release. For example, Netskope deprecates release 210.x.x.x and older releases when release 213.x.x.x is available.

Backward compatibility does not include releases that:

Are not guaranteed to work with the latest cloud releases
Are no longer tested by Netskope.
Do not receive hotfixes updates..
Do not receive new feature updates.

If you are running older versions of Netskope Adapter, you can upgrade to the latest version without any issue. However, Netskope recommends to backup the AD Importer directories and store them in a different location. You can find the files in the following path:

C:\Users\Public\Netskope\
C::\Program Files\Netskope\NSAdapters\

C:Users>dsquery user domainroot -name * -u username1 -p 123456789 "CN=Administrator,CN=Users,DC=exampledomain,DC=local" "CN=Guest,CN=Users,DC=exampledomain,DC=local" "CN=Guest2,CN=Users,DC=exampledomain,DC=local" "CN=username1,OU=UserInfoDistOU1,DC=exampledomain,DC=local" "CN=username2,OU=UserInfoDistOU1,DC=exampledomain,DC=local" "CN=username3,OU=UserInfoDistOU2,DC=exampledomain,DC=local" "CN=user.exampleorg1.test,OU=exampleorg,DC=exampledomain,DC=local" "CN=user.exampleorg2.test,OU=exampleorg,DC=exampledomain,DC=local" "CN=user.exampleorg3.test,OU=exampleorg,DC=exampledomain,DC=local"