Microsoft Group Policy Object (GPO)

To install the Netskope client:

1. Create a source distribution folder and copy the standard Netskope client installer (.msi) into the folder.

2. Verify the source distribution folder is shared and is accessible from all domain computers.

3. Create a batch file(.bat) in the source distribution folder and add following lines of command.

   @echo off
   SetLocal EnableDelayedExpansion
   
   REM ================================
   REM Define the version to install
   REM ================================
   set "newver=<version number of msi in x.x.x.x format>"
   set "newVernum=%newver:.=%"
   
   REM ================================
   REM Get installed version using PowerShell
   REM ================================
   for /f "usebackq tokens=* delims=" %%v in (`powershell -NoProfile -Command "(Get-CimInstance Win32_Product | ? Name -eq 'Netskope Client').Version"`) do (
       set "instVer=%%v"
   )
   
   REM ================================
   REM If not installed → install
   REM ================================
   if not defined instVer (
       echo Netskope Client not found. Installing new version...
   	msiexec /I "<UNC path of source distribution folder><msi name with extension>" host=<host> token=<org_id> mode=peruserconfig fail-close=[no-npa|all] /l*v %PUBLIC%\nscinstall.log
       goto :EOF
   )
   
   REM ================================
   REM Compare versions
   REM ================================
   set "instVerNum=%instVer:.=%"
   
   echo Installed Version: %instVer%
   echo New Version: %newver%
   
   REM Install if new version >= installed version
   if "%newVernum%" GEQ "%instVerNum%" (
       echo New version is equal or greater. Installing...
      msiexec /I "<UNC path of source distribution folder><msi name with extension>" host=<host> token=<org_id> mode=peruserconfig fail-close=[no-npa|all] /l*v %PUBLIC%\nscinstall.log
   ) else (
       echo Installed version is newer. No installation will be performed.
   )
   
   EndLocal

   • Replace values provided within < > with your tenant data.
   • ​If ​Secure Enrollment​​ is enabled, each deployment mode consists of two additional parameters(Authentication and Encryption token):
   • ​​​enrollauthtoken:​​ Specifies the authentication token.
   ​​​
   • enrollencryptiontoken:​​ Specifies the encryption token.

4. Create a GPO to install the Netskope client.

5. Edit the GPO.

   1. Go to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown).

   2. Add the batch file as a Startup Script. The script should be specified along with its UNC path (network share).

      The script path should not be a local share path.

   3. Refresh and update the GPO policies.

Admin must create and schedule a GPO task to reboot all the domain computers to apply the startup script that is created in above section. If a user manually uninstalls the Netskope client, the same will be reinstalled through Group Policy during next restart of their computer.

You can use MST files to deploy Netskope Client across organization units. To deploy clients via MST:

The following procedure illustrates the steps to create an MST package using the ORCA database table editor. The Orca tool is available via the Microsoft SDK. You can download the orca tool here and to learn more about the orca tool, visit this orca webpage.  

1. Open ORCA tool and go to File > Open to select Netskope Client installer (.msi) file.

   

2. You will now see the list of all tables in the installer file. Click Property to view all installer property values.

   

3. Select Transform > New Transform.

   

4. To deploy Netskope Client, you will need to add the following additional property values to this table. The fields in the property table are a combination of two strings (property name and its value).

   • HOST – Enter the tenants add-on URL (example: addon-tenantname.example.com).

   • TOKEN – Enter the tenants organization ID.

   • MODE – Enter peruserconfig (or the mode that you suits your deployment needs).

   • AUTOUPDATE – Enter [ on or off ]. This is an optional value. If set to on, the client will auto updated to the next available version as specified in the client configuration.

   • INSTTAG – Enter the device tag name. This is an optional value. Ensure that you a device tag that is configured in Manage Tags.

   The property name must be entered in all caps.

5. To add a new property value, select Property from the table list and then right click on the right pane and select Add Row.

   

6. Enter the Property name (in all CAPS) and then click on the Value text box and enter the value string.

   

7. Repeat this to add all the required property values.

   

8. Go to Transform > Generate Transform and give it a name. This creates the MST deployment file.

The following steps illustrate the procedure to deploy the Netskope Client using the created MST package via MS group policy objects.