Skip to main content

Netskope Help

Netskope Client For Windows

The MSIEXEC command is used to mass deploy Netskope Client (MSI packages) on Windows devices.

Supported Operating Systems

Refer to Netskope Client Supported OS and Platform to understand the supported versions for Windows.

Download Client Packages

You can download Netskope client installers from Download Netskope Client and Scripts.

MSIEXEC Command Format

The generic format of MSIEXEC command to install Client is as follows:

msiexec /I NSClient.msi host=addon-<tenant>[.region].goskope.com token=<Organization ID> [installmode=IDP] [mode=peruserconfig [userconfiglocation=<path>]] [fail-close=no-npa|all] [autoupdate=on|off] [/l*v %PUBLIC%\nscinstall.log]

For example, use the following command to install Netskope Client in a multi-user system with an auto-update option:

msiexec /I NSClient.msi host=addon-corp.goskope.com token=ifxqWJDBVoLFxmAUq36v mode=peruserconfig autoupdate=on /l*v %PUBLIC%\nscinstall.log

Note

Enter the command in a single line without any line-breaks.

Parameter

Description

/i

Optional Command. Refers to normal installation type.

mode

Optional parameter. Use peruserconfig when installing in a multi-user system.

prelogonuser

Optional parameter. Use prelogonuser when installing in a single user system.

installmode

Optional parameter. Use Idp value when provisioning users via IdP.

userconfiglocation

Specifies the user-specific directory used for storing the user configuration. It is recommended to use default value unless user's home directories are hosted on external file servers or network shares. This is recommended to be used only for the multi-user environment.

This is an optional parameter. By default the path is %AppData%\Netskope\STAgent.

Note

The path can be an absolute path, a network share, or a path having environment variables.

  • To run the above from command prompt with environment variables, append '^' before '%'.

    Example: /I NSClient.msi mode=peruserconfig userconfiglocation=C:\Users\^%USERNAME^%\Netskope

  • To run the above command from a batch script with environment variables, append '%' before '%'.

    Example: /I NSClient.msi mode=peruserconfig userconfiglocation=C:\Users\%%USERNAME%%\Netskope

  • To run the above command from SCCM (or ) with environment variables, append '^' before '%' and prefix with "cmd /c".

    Example: cmd /c /I NSClient.msi mode=peruserconfig userconfiglocation=C:\Users\^%USERNAME^%\Netskope

fail-close

Optional parameter. If fail-close is not present, the client will honor Web UI "fail close" client configuration.

  • all: Fail close will be applicable to CASB / Web traffic for the NPA tunnel too. Example: If the Netskope tunnel is not established, NPA's application traffic will also be blocked.

  • no-npa: Fail close will be applicable only for CASB / Web traffic but not for NPA tunnel.  Example: If the Netskope Tunnel is not established, NPA's application traffic will NOT be blocked.

autoupdate

  • on

  • off

token

Enter your organization ID here. To find your organization ID.

  1. Login to your Netskope Admin Console with admin credentials.

  2. Go to Settings > Security Cloud Platform > MDM Distribution.

  3. Locate your Organization ID under Create VPN Configuration section. The organization ID is case-sensitive.

host

Enter the addon URL of your tenant. For example: if your tenant URL is example.goskope.com, then your addon URL is = addon-example.goskope.com

domain

Enter the domain URL= [region.]goskope.com during IDP enrollment.

tenant

Enter the tenant name.

/l*v

The log file path.

/qn

Use this option for silent installation.

Note

The /j option is not supported while using the msiexec command for Netskope Client installation.

A few other examples for the Client installation are as follows:

  • Single-User Mode Installation for Domain-joined Endpoints: System-level enrollment including local non-AD accounts; auto-enrolled one time based on the UPN of the first domain user to log in.

    msiexec /I NSClient.msi host=addon-<tenant>[.region].goskope.com token=<Organization ID>

    Example: msiexec /I NSClient.msi host=addon-corp.goskope.com token=ifxqWJDBVoLFxmAUq36v

  • Multi-User Mode Installation for Domain-joined Endpoints: Per-user enrollment; each user auto-enrolled at login based on their UPN.

    msiexec /I NSClient.msi host=addon-<tenant>[.region].goskope.com token=<Organization ID> mode=peruserconfig

    Example: msiexec /I NSClient.msi host=addon-corp.goskope.com token=ifxqWJDBVoLFxmAUq36v mode=peruserconfig

Netskope Client Deployment Commands

  • Microsoft Endpoint Configuration Manager

    msiexec /I NSClient.msi token=<token> host=<host> [mode=peruserconfig | installmode=IDP [userconfiglocation=<path>]] fail-close=[no-npa|all] [autoupdate=on|off].

    To learn more, view Microsoft Endpoint Configuration Manager.

  • VMware Workspace One 

     msiexec /I NSClient.msi installmode=idP tenant=corp domain=eu.example.com /qn

    To learn more, view VMware Workspace ONE. VMWare Workspace One

  • IDP For Client Deployment

    This includes two modes:

    • Single-User Mode Installation for IdP-based Enrollment: System-level enrollment based on the first user to enroll the Client viaIdP.

      msiexec /I NSClient.msi tenant=<tenant> domain=[region.]goskope.com installmode=IDP

      Example: msiexec /I NSClient.msi tenant=corp domain=eu.goskope.com installmode=IDP

    • Multi-User Mode Installation for IdP-based Enrollment: Per-user enrollment; each user must enroll the Client via IdP. 

      msiexec /I NSClient.msi tenant=<tenant> domain=[region.]goskope.com installmode=IDP mode=peruserconfig

      Example: msiexec /I NSClient.msi tenant=corp domain=eu.goskope.com  installmode=IDP mode=peruserconfig

    To learn more, view Deploy Netskope Client via IdP.

  • Microsoft Intune

    Use the Command-Line arguments: token=<organization id> host=addon- <tenant-name> .goskope.com mode=peruserconfig (Use peruserconfig only for multi-user environments) autoupdate=on (only applicable if you want the client to auto-update) /qn

    To learn more, view Deploy Client On Windows Using Intune

  • Microsoft Group Policy Object (GPO)

    You can deploy Netskope Client to Active Directory (AD) joined devices via Microsoft GPO using a script based or MST based deployment option.

    To learn more, view Microsoft Group Policy Object (GPO)

  • Prelogon Connectivity for Netskope Private Access

    To install and enable the Netskope Client for Netskope Private Access Prelogon connectivity, use these commands.

    For single user mode

    The user needs to be different for each Client config. For example:

    Client config1

    msiexec /I NSClient.msi token=<token> host=<host> prelogonuser=user1@prelogon.netskope.com

    Client config2

    msiexec /I NSClient.msi token=<token> host=<host> prelogonuser=user2@prelogon.netskope.com

    For per user mode

    For per user mode, different Client configs also have different prelogon users.

    msiexec /I NSClient.msi token=<token> host=<host> mode=peruserconfig <prelogonuser=user1@prelogon.netskope.com
    msiexec /I NSClient.msi token=<token> host=<host> mode=peruserconfig <prelogonuser=user2@prelogon.netskope.com
In this section: