Microsoft Endpoint Configuration Manager - Netskope Knowledge Portal

Using the Microsoft Endpoint Configuration Manager, you can install Netskope lient on the Windows endpoints without any user intervention. After the installation, the client can detect the logged in user’s AD login name and download the branding information for the user from the Netskope cloud.

A branding file is a JSON file that contains user details (for example, email address), the addon server URL, and other configuration rules for this user.

Starting in version 1910, Configuration Manager is now part of Microsoft Endpoint Manager. Reference – Microsoft Docs.

Prerequisites

Install and configure Directory Importer to fetch email addresses and usernames from Active Directory. Use Directory Importer version 2.24 or above for importing AD users to Netskope system. This has the capability to capture the user’s principal name (UPN) along with the user’s email ID.

For details on installing and configuring Netskope Adapters, refer to the Netskope Adapters.
Download the Netskope Client installer file from the Netskope Support Portal . Download the MSI file for Windows.
When using SCCM, you will first create a installer package and then use that to install Netskope Clients on the end user devices.
Administrators must review Netskope Client Client Enrollment Methods to understand the Client User Enrollment methods available for their environment.
Import users into the Netskope tenant – see Provisioning Users for Netskope Client.

Supported Platforms and Enrollment Methods

Enrollment Method	Single-User	Multi-User
IDP	Yes	Yes
UPN	Yes	Yes

Install Client

Execute the following command to install the client using the MSI file (the installation package) in a multi-user environment.

IDP

UPN

msiexec /I NSClient.msi tenant=<tenant-name> domain=[region.]<tenant-domain> installmode=idp [enrollauthtoken=<Authentication Token>] [enrollencryptiontoken=<Encryption Token>] [mode=peruserconfig [npavdimode=on] [userconfiglocation=<path>]] [fail-close=no-npa|disable] [prelogonuser=<prelogon username>@prelogon.netskope.com] [autoupdate=on|off] [enforceenrollsteeringprofileid=<steering profile ID>] [enforceenrollfrequency=<time in minutes>]  [/l*v %PUBLIC%nscinstall.log] [/qn]

If you are using Enforce enrollment parameters, ensure to add the the following parameters:
– host=addon-<tenant-name>.[region.]<tenant-domain>
– token=<Organization ID>

To learn more, view Netskope Client MSIEXEC Parameters.

msiexec /I NSClient.msi host=addon-<tenant-name>.[region.]<tenant-domain> token=<Organization ID> [enrollauthtoken=<Authentication Token>] [enrollencryptiontoken=<Encryption Token>] [mode=peruserconfig [npavdimode=on] [userconfiglocation=<path>]] [fail-close=no-npa|disable] [prelogonuser=<prelogon username>@prelogon.netskope.com] [autoupdate=on|off] [/l*v %PUBLIC%nscinstall.log] [/qn]

If multiple users do not share a system, Netskope recommends that you install the Client in single-user mode. In a multi-user system/devices, the client is installed for all users in that system that have an AD account. The client is not installed for local users and therefore traffic from apps used by a local user is not steered to the Netskope cloud. Also, if the mode is not specified, the Client is installed in single-user mode.

Install Netskope Client in a Multi-User Environment

In addition to installing the Client for a single user, you can install it to provide user visibility for cases where multiple users are sharing the same system. Examples of this include:

Persistent and Non persistent VDI
Citrix Xenapp with Hosted Shared Desktop (HSD)
Windows Remote Desktop Services
Floating/Loaner Laptops, when loaner PCs that are given to employees on a temporary basis.
Kiosk Desktops, such as shared desktops in call centers, conference rooms, front desks.