Netskope Client For Windows

The MSIEXEC command is used to mass deploy Netskope Client (MSI packages) on Windows devices.

Refer to Netskope Client Supported OS and Platform to understand the supported versions for Windows.

You can download Netskope client installers from Download Netskope Client and Scripts.

The generic format of MSIEXEC command to install Client is as follows:

msiexec /I NSClient.msi host=addon-<tenant-name>[.region].<tenant-domain> [token=<Organization ID>] [installmode=IDP] [mode=peruserconfig [userconfiglocation=<path>]] [fail-close=no-npa|all] [autoupdate=on|off] [/l*v %PUBLIC%nscinstall.log]

For example, use the following command to install Netskope Client in a multi-user system with an auto-update option:

msiexec /I NSClient.msi host=addon-<tenant-URL> token=ifxqWJDBVoLFxmAUq36v mode=peruserconfig autoupdate=on /l*v %PUBLIC%nscinstall.log

A few other examples for the Client installation are as follows:

This section provides the instructions to uninstall Netskope Client from your Windows devices. You can uninstall using multiple methods such as manually from Settings in Windows, from command-line using MSIEXEC, and so on.

Uninstall Manually

To uninstall Client from Settings in Windows:

You can check Apps & features under Apps to ensure that the Netskope Client is uninstalled from your device. To learn more about uninstalling Client from other features in Windows, view Uninstall Apps in Windows.

The Password protection for client uninstallation and service stop option under Client Configuration > Tamperproof lets the administrator restrict unauthorized uninstallation of Client by the end users. The end user must know the password set by the administrator while uninstalling the Client. To learn more, view Netskope Client Configuration.

Using MSI file From Command-Line

To uninstall Client:

1. Open a command prompt as an administrator.

2. Enter the following command:

   msiexec /uninstall %productCode% PASSWORD="<password in plain text within quotes>" /qn /l*v %PUBLIC%nscuninstall.log

   • Use the following command to find the product code:
     wmic product where "Name like 'Netskope Client'" get IdentifyingNumber /value
   • Use the same password that is configured under Tamperproof in Client Configuration.

Using GPO Scripts

Uninstalling can be done through GPO using a batch script similar to installation. The uninstallation script is:

wmic product where name="Netskope Client" call uninstall

Using Script in SCCM

@echo off
REM
REM This batch file is used to uninstall Password protected Netskope Client from SCCM
REM
SetLocal
for /f "tokens=2 delims==" %%f in ('wmic product where "Name like 'Netskope Client'" get IdentifyingNumber /value ^| find "="') do set "productCode=%%f"
IF DEFINED productCode (
     msiexec /uninstall %productCode% PASSWORD="<password in plain text within quotes>" /l*v %PUBLIC%nscuninstall.log  /qn
     ) ELSE (
REM Did not find product code for Netskope Client
)
EndLocal

Multilingual Support For Windows

Netskope supports the following languages for end-user support:

• French

• German

  This helps non-english speaking users to understand Netskope Client menu and notifications. To display end-user Netskope Client notifications in French and German, modify your language and region settings in the Windows devices. To learn more about how to change your language and region settings in your Windows devices, view Manage display language settings in Windows.

Windows Support For WSLv2

Netskope Client supports Windows Subsystem for Linux (WSL) version 2 that allows you to run  Linux on your Windows devices without the need of a separate virtual machine. This enables a seamless and simultaneous usage of Windows and Linux operating systems. You can deploy Netskope Client for Linux onto a Linux distribution to extend Netskope services to wSLv2 Linux environment.

To learn more, view Install Linux on Windows Using WSL.

Support Versions

• Windows OS: Windows 10 and later versions.

• WSLv2  and Minor Version 0.67.6 or above.

• Netskope Client: Version 113.0.0 or later.

Limitations

• WSL Linux distribution contains no login name as it does not support UI desktop by default. This info only appears as an install log message and not used by Netskope Client features. Hence it does not impact any functionalities.

• The device manufacture information is not available in WSL Linux distributions. There is no file naming “/sys/devices/virtual/dmi/id/sys_vendor” that the manufacturer comes from. The information is for display only, it doesn’t impact any functionalities of the products.

• If Netskope Client for Linux is installed before the installation of applications such as Firefox and Chrome and so on, the WSL distro needs reboot to make the browsers working.

In instances where the user forgets to enable a Client after disabling it, Netskope set a feature flag AutoStart NSClient with Reboot/Relogin to enable the Netskope Client. After the administrator enables the feature flag, the Netskope Client is enabled after the user restarts the system or the user logs off and logs in again.

In certain situations, the Netskope Client may be susceptible to various issues during the auto-upgrade process and the Client installer needs to handle the failure and revert to the previous version.

In the event of any upgrade/uninstall failures, the Netskope Client rollback to the previous version of the client thereby preventing the removal of the Client from the end-user device.

You can go to Settings > Security Cloud Platform > Netskope Client > Devices to view the events displayed during the Client upgrade failure. Click the device name to view the related events and the corresponding details. The following table lists the different events displayed in the event of a Client upgrade or uninstallation:

Rollback Success, Upgrade Failure, Installed

Rollback Failure

Uninstalled, Uninstallation Failure

Upgraded

There are occurrences where the auto-upgrade processes gets impacted due to unplanned events such as:

To eliminate this issue, during the upgrade process, Netskope creates an installation monitor service stAgentSvcMon.exe that is a copy of the existing Netskope Client Services, with limited functionality. The installation monitor service relaunches the Client installation process on the end-user device whenever the auto-upgrade process is interrupted by system restart/crash/shutdown/hard-reboot/power failure. Once the auto-upgrade process is completed, this monitor service is removed from the endpoint.

However, there are a few scenarios that would stop the monitor service from relaunching the Client installation process. Refer to the following table to learn more:

Private Access Tunnel Status Update in Windows Registry

Private Access service on Netskope Windows Client updates the status of the tunnel in the following registry location: 

HKEY_LOCAL_MACHINE\SOFTWARE\NetSkope\NpaTunnel/NpaStatus 

Status Descriptions 

Tunnel Status              Registry Value

Enabled                        Connected

Disabled                       Disconnected

In addition, the timestamp at which this status change was made is updated in the following registry location: HKEY_LOCAL_MACHINE\SOFTWARE\NetSkope\NpaTunnel/NpaStatusLastChanged.