Troubleshooting guidelines

This guide provides a structured decision tree for diagnosing and resolving common Enterprise Browser issues. Use the symptom categories below to quickly identify the likely cause and apply the recommended resolution. For installation-specific issues, refer to the existing Installation and Troubleshooting page.

Symptom Decision Tree

Use the following categories to identify the symptom, then follow the diagnostic steps to reach a resolution.

Installation and Update Failures

Symptom: File permission errors or file access errors during installation

• Likely cause – Antivirus or EDR software blocking the installation flow.
  
• Resolution – Allowlist the following paths in your security software:
  • C:\Users\<USERNAME>\AppData\Local\Netskope\Browser
    
  • C:\Users\<USERNAME>\AppData\Local\Netskope\NetskopeBrowserUpdater
    
  • C:\Users\<USERNAME>\AppData\Local\Temp
    
  • C:\Windows\Installer (MSI installation only)
    
  • Registry key: HKCU\Software\Netskope\Update
    

Symptom: MSI installation succeeds but no profile is created (MDM deployment)

• Likely cause – Profile creation failed silently. The MSI installer does not fail if profile creation fails.
  
• Resolution – Check the Windows Registry at HKCU:\Software\Netskope\Update\LastInstallerError for the exit code:
  • 0 (ERROR_SUCCESS) – Profile created successfully.
    
  • 1602 (ERROR_INSTALL_USEREXIT) – Installation interrupted by user.
    
  • 1603 (ERROR_INSTALL_FAILURE) – Profile creation failed. Verify that the license is valid and the device can reach the configuration server.
    
  • 1619 (ERROR_INSTALL_PACKAGE_OPEN_FAILED) – MSI file not accessible. Check for antivirus or EDR interference.
    
  • 1638 (ERROR_PRODUCT_VERSION) – An older version exists. Fully remove the old version and retry.
    

Network Connectivity Issues

Symptom: “Failed to retrieve data. Check your network connection”

• Likely cause – Enterprise Browser cannot reach Netskope’s configuration services.
  
• Resolution – Verify that the following domains and ports are reachable from the device:
  • https://nsbrowser-updates.<MP>.goskope.com – Browser updates and installer downloads
    
  • https://nsbrowser-config.<MP>.goskope.com – Tenant and user configurations
    
  • eproxy-<tenant-name>.goskope.com:8090 – Secure proxy for internet traffic
    
  • <tenant-name>.ebnpa.goskope.com:8090 – Secure proxy for private apps (if NPA is enabled)
    

Symptom: ERR_TIMED_OUT when browsing

• Likely cause – Enterprise Browser cannot connect to the secure proxy.
  
• Resolution – Verify that eproxy-<tenant-name>.goskope.com:8090 is reachable. Check firewall rules for port 8090 (HTTP). If a corporate proxy is in place, ensure it allows HTTP connections to this endpoint.
  

Symptom: Intermittent 401 Unauthorized or 403 Forbidden on third-party sites

• Likely cause – The target website’s security filters do not recognize Enterprise Browser’s User-Agent string.
  
• Resolution – This is a known limitation. Some third-party sites with strict browser-validation policies may intermittently reject connections. There is no customer-configurable workaround at this time. If the issue is persistent for a critical application, escalate to Netskope support.
  

Authentication and SSO Failures

Symptom: SSO login fails or gets stuck on the authentication screen

• Likely cause – The majority of SSO issues are caused by IdP misconfiguration, particularly missing domains in the proxy bypass list or incorrect SAML Forward Proxy setup.
  
• Resolution – Review the IdP setup documentation for your provider: Okta, PingIdentity, or Microsoft Entra. Verify that all required IdP domains are included in the proxy bypass list and that the SAML Forward Proxy configuration matches the guide exactly.
  

Symptom: “Your license is not correct” during profile creation

• Likely cause – The license key was entered incorrectly or has expired.
  
• Resolution – Re-enter the license key carefully. If the error persists, verify the license status in the admin console and generate a new one if needed.
  

Symptom: “License has been deleted” or “License was deactivated”

• Likely cause – The admin deleted or deactivated the license.
  
• Resolution – Generate a new license in the admin console and share it with the user.
  

Symptom: Microsoft Conditional Access policy blocking Enterprise Browser

• Likely cause – The organization’s Conditional Access policy does not recognize Enterprise Browser.
  
• Resolution – Enable the “Microsoft Single Sign-on” extension and set CloudAPauthEnabled on the tenant configuration.
  

Certificate Errors

Symptom: Certificate errors on iOS

• Resolution steps:
  1. Verify iOS version is 17.0 or later.
     
  2. Confirm certificate installation: Settings > General > VPN & Device Management — check that Netskope Local Proxy Certificate is installed.
     
  3. Confirm certificate trust: Settings > General > About > Certificate Trust Settings — check that Netskope Local Proxy CA is trusted.
     
  4. If the issue persists, collect logs and escalate.
     

Browser Protection Policy Issues

Symptom: Copy/paste or print restrictions are not applied

• Resolution steps:
  1. Verify the policy is correctly configured and assigned to the user or group in the admin console.
     
  2. Confirm that the user belongs to the group or OU targeted by the policy.
     
  3. Reload policies: close all browser windows, reopen the browser, and verify at netskope://policy.
     
  4. Note: Policies are not applied when a new user is added to an existing group/OU until the policy is updated. Re-save the policy to trigger distribution.
     

Symptom: “Export as PDF” is not blocked by print restrictions

• Likely cause – Some applications (such as Microsoft 365) offer “Export as PDF” through the print menu, which triggers a download rather than a print action.
  
• Resolution – Create a Real-time Protection DLP policy to block downloads for the affected application, in addition to the print blocking policy.
  

Symptom: Screenshot protection is bypassed

• Likely cause – Known scenarios where screenshot protection may not be effective:
  • Kernel-level capture tools that operate at the OS driver level
    
  • Chromium DevTools screenshot function
    
  • Certain browser extensions using internal browser APIs
    
  • macOS: duplicating a protected tab or resizing the window
    
  • Android: system-level screenshot in the Overview/Recents screen
    
• Resolution – These are known limitations. Consider complementary DLP controls for highly sensitive content.
  

Symptom: Policies are not applied on SSL-bypassed connections

• Likely cause – By design, Enterprise Browser policies are not evaluated for domains that are bypassed in the EB bypass settings.
  
• Resolution – If policy enforcement is required for a specific domain, remove it from the bypass list.
  

Performance Issues

Symptom: Slow page loads or general performance degradation

• Resolution steps:
  1. Test the same sites in another browser to confirm the issue is specific to Enterprise Browser.
     
  2. Close unnecessary applications consuming system resources.
     
  3. Verify no enterprise firewall rules or network filters are adding latency.
     
  4. Check NewEdge POP selection — Enterprise Browser uses DNS resolution for optimal POP selection, which may differ from POP selection when the Netskope Client is active.
     

NPA (Private App) Access Issues

Symptom: “Service Unavailable: Netskope was unable to…” when accessing private apps

• Resolution steps:
  1. Verify the NPA Browser Access app definition is created and matches the private app’s hostname.
     
  2. Confirm a Real-time Protection policy exists for the app.
     
  3. Verify <tenant-name>.ebnpa.goskope.com:8090 is reachable from the device.
     
  4. If using Enterprise Browser with the Netskope Client, verify the Certificate Pinned App exception is configured correctly.
     

Collecting Diagnostic Data

When the above steps do not resolve the issue, collect the following data before escalating to Netskope support.

Minimum Information Required

Collect these items for every support case:

• OS and browser version – Go to netskope://version and copy the full version string.
  
• Chromium policies – Go to netskope://policy, click More actions, and export policies as JSON.
  
• Browser logs – Close all browser windows completely, then reopen with logging enabled:
  • Windows: C:\Users\<USERNAME>\AppData\Local\Netskope\Browser\Application\nsbrowser.exe –enable-logging=stderr
    
  • macOS: /Applications/Netskope\ Enterprise\ Browser.app/Contents/MacOS/Netskope\ Enterprise\ Browser –enable-logging=stderr
    
• HAR file (if the issue involves a specific site) – Open Developer Tools, go to the Network tab, enable Preserve Log and Disable cache, reproduce the issue, then export the HAR file.
  

Advanced Diagnostics (Provide Only When Requested)

• Net-export capture – Go to netskope://net-export, start logging, reproduce the issue, then stop logging and share the JSON file. Note: this captures all network connections including cookies and credentials.
  
• Support tool bundle – Go to netskope://support-tool/, select the diagnostic categories relevant to the issue, and export the ZIP file.
  
• Browser updater log:
  • Windows: C:\Users\<USERNAME>\AppData\Local\Netskope\NetskopeBrowserUpdater\updater.log
    
  • macOS: ~/Library/Application Support/Netskope/NetskopeBrowserUpdater/updater.log
    
• Installer log:
  • Windows: C:\Users\<USERNAME>\AppData\Local\Temp\netskope_installer.log
    
  • macOS (PKG): /var/log/install.log
    
• User profile copy (if profile corruption is suspected) – Find the profile path at netskope://version under Profile Path.
  

Mobile Diagnostics

Android:

• Network logs: netskope://net-export — tap Start Logging to Disk, reproduce the issue, then Stop Logging and email or share the file.
  

iOS:

• Network logs: netskope://net-export — tap Start Logging to Disk, reproduce the issue, then Stop Logging and email the file.
  
• Device logs: Settings > Privacy & Security > Analytics & Improvements > Analytics Data — search for entries starting with “Netskope-“.
  
• Console logs: Use the macOS Console app or Xcode with the device connected.
  
• Policy export: netskope://policy — tap More Actions > Copy as JSON.
  

Considerations

Considerations include:

• HAR files and net-export logs contain sensitive information (cookies, credentials, internal URLs). Handle with appropriate confidentiality.
  

Troubleshooting Network Connectivity for the Enterprise Browser

Enterprise Browser requires uninterrupted network access to several Netskope cloud services for configuration retrieval, browser updates, and secure traffic steering. When connectivity to any of these services is blocked or degraded, users experience profile creation failures, browsing timeouts, or inability to receive policy updates. This guide helps administrators diagnose and resolve network connectivity issues including local proxy failures, certificate errors, configserv unavailability, and network requirements verification.

Network Requirements

Enterprise Browser requires outbound access to the following services. Without full access to these domains and ports, Enterprise Browser will not function.

Outbound HTTPS (Port 443)

• `nsbrowser-updates.<MP>.goskope.com` – browser updates and installer downloads
  
• `nsbrowser-config.<MP>.goskope.com` – tenant and user configuration retrieval (configserv)
  
• `ns-authservice.goskope.com` – SSO authentication service
  

Outbound HTTP (Port 8090)

• `eproxy-<tenant-name>.goskope.com:8090` – secure proxy for steering internet-bound traffic through Netskope
  
• `<tenant-name>.ebnpa.goskope.com:8090` – secure proxy for private app access (only required if NPA is enabled)
  

DNS Resolution

• All *.goskope.com domains must be resolvable from the user’s device
  
• Corporate DNS must not block or redirect lookups for *.goskope.com
  
• If split-DNS is in use, configure forwarding rules for the goskope.com zone
  

Proxy and Firewall Considerations

If your organization routes traffic through a corporate proxy:

• HTTPS proxy configuration must allow connections to *.goskope.com on port 443
  
• HTTP proxy configuration must allow connections to eproxy-*.goskope.com on port 8090
  

Verifying Network Connectivity

To verify that a device can reach all required Netskope services, you can use the Enterprise Browser Network Connectivity Tool or test each endpoint from the target network using standard tools (browser, curl, or nslookup).

Enterprise Browser Network Connectivity Tools

You can find this tool here: https://eb-check.netskope.io/

The Netskope Enterprise Browser Network Connectivity Validation Tool is a web-based utility that helps validate network access to critical Netskope services before deploying the Enterprise Browser. Many enterprise customers face network infrastructure challenges that can prevent successful deployment of the Netskope Enterprise Browser. This tool addresses specific customer pain points (e.g. strict firewall rules, complex proxy configurations).

Manual Verification Steps

1. DNS resolution – run nslookup nsbrowser-config.<MP>.goskope.com and nslookup nsbrowser-updates.<MP>.goskope.com to confirm both domains resolve.
   
2. Configuration service (HTTPS/443) – open https://nsbrowser-config.<MP>.goskope.com in a browser or run curl -s https://nsbrowser-config.<MP>.goskope.com. A JSON response {“code”:5,”message”:”Not Found”,”details”:[]} confirms the service is reachable. This 404 response is expected — it means the service is up and responding to anonymous requests.
   
3. Browser updates service (HTTPS/443) – same test against https://nsbrowser-updates.<MP>.goskope.com. Same expected 404 response.
   
4. Secure proxy (HTTP/8090) – run curl -s http://eproxy-<tenant-name>.goskope.com:8090. Any HTTP response (200, 302, 401, 403) indicates the proxy is reachable.
   

Interpreting Results

• All endpoints respond – network is ready for deployment. All required ports, DNS, and proxy configurations are correct.
  
• Some endpoints fail – identify which specific service is unreachable and apply the corresponding resolution from the troubleshooting sections below.
  
• All endpoints timeout – complete network blockage to *.goskope.com. Check internet connectivity and verify no firewall rule blocks all external access to these domains.
  
• Connection timeout (more than 10 seconds) – firewall is silently dropping packets rather than rejecting them. Work with the network team to allowlist the specific domain.
  
• “Connection refused” or immediate failure – the connection was actively rejected. Verify port 8090 is open for the Secure Proxy service.
  

Diagnosing Local Proxy Failures

Enterprise Browser uses a local MITM proxy on mobile platforms (iOS and iPadOS) to intercept and steer traffic through the Netskope cloud. On desktop platforms (Windows and macOS), traffic steering uses the Cloud Explicit Proxy (CEP) model without a local proxy.

Symptoms

• Pages fail to load on iOS with ERR_PROXY_CONNECTION_FAILED
  
• Browsing works intermittently then stops on mobile
  
• Navigation fails during token expiry or refresh on iOS
  

Resolution Steps

1. Verify the local proxy certificate is installed and trusted on the device:
   

• Settings > General > VPN & Device Management — confirm Netskope Local Proxy Certificate is present.
  
• Settings > General > About > Certificate Trust Settings — confirm Netskope Local Proxy CA is enabled.
  

2. If the certificate is missing, redeploy it via MDM or have the user install the .mobileconfig profile manually.

3. Check that the device is not on a captive portal network — captive portals intercept the initial proxy connection and can cause authentication failures.

4. Collect network logs (netskope://net-export) and escalate to engineering if the issue persists after certificate verification.

Diagnosing Certificate Errors

Desktop (Windows and macOS)

Symptom: `ERR_CERT_AUTHORITY_INVALID` or certificate warnings on specific sites

• Likely cause – An SSL inspection appliance is re-signing traffic to Netskope services, breaking certificate pinning.
  
• Resolution – If the Netskope Client is deployed alongside Enterprise Browser, the Client’s SSL bypass list may not include the affected domains. When the Client intercepts traffic that Enterprise Browser expects to handle directly, certificate mismatches occur.
  
• Resolution – In the Netskope One admin console, verify the Netskope Client steering configuration.
  

Mobile (iOS and iPadOS)

Symptom: `ERR_CERT_AUTHORITY_INVALID` on all sites in Enterprise Browser

• Likely cause – The Netskope Local Proxy CA certificate is not trusted on the device.
  
• Resolution:
  

1. Go to Settings > General > VPN & Device Management and verify the certificate is installed.

2. Go to Settings > General > About > Certificate Trust Settings and enable full trust for Netskope Local Proxy CA.

3. If deploying via MDM, ensure the MDM configuration profile includes both the certificate payload and the certificate trust payload.

Symptom: NPA connections fail with certificate verification errors on iOS

• Likely cause – CACerts from policy have not been added to the certificate store, causing the local proxy to reject certificates not in the pinned SPKI list.
  
• Resolution – Update to the latest Enterprise Browser version, which includes fixes for NPA certificate verification on iOS (resolved in ENG-1000670).
  

Diagnosing Configuration Service (ConfigServ) Unavailability

Symptoms

• “Failed to retrieve data. Check your network connection” during profile creation
  
• Policies do not update after changes in the admin console
  
• Browser shows stale configuration after network changes
  

Resolution Steps

1. Verify reachability of https://nsbrowser-config.<MP>.goskope.com using a direct HTTPS request from the affected machine (see Verifying Network Connectivity above).
   
2. If the service is unreachable:

• Check DNS resolution: nslookup nsbrowser-config.<MP>.goskope.com
  
• Check firewall rules for port 443 to this domain
  
• Check proxy configuration — ensure the corporate proxy does not block or modify requests to this domain
  

3. If the service is reachable but returns unexpected responses:

• Verify that SSL inspection is not active for this domain
  
• Check that the response body contains valid JSON (expected: {“code”:5,”message”:”Not Found”,”details”:[]} for anonymous requests)
  

4. If the issue affects only specific users or machines, verify that the license key is valid and the user’s profile is active in the admin console.

Diagnosing Secure Proxy (CEP) Connectivity

Symptoms

• ERR_TIMED_OUT when browsing any website
  
• Pages load in other browsers but not in Enterprise Browser
  
• “Unable to reach the internet” error pages
  

Resolution Steps

1. Verify reachability of eproxy-<tenant-name>.goskope.com:8090 — this must be accessible over HTTP (not HTTPS).
   
2. Common causes of failure:

• Port 8090 blocked – many corporate firewalls only allow ports 80 and 443. Work with the network team to open port 8090 for eproxy-*.goskope.com.
  
• HTTP traffic blocked – some organizations block all non-HTTPS traffic. The secure proxy requires an initial HTTP connection on port 8090.
  
• Captive portal interference – if the user is on a network with a captive portal, the portal may intercept the HTTP connection to the proxy. The user must complete captive portal authentication before Enterprise Browser can connect.
  

3. If NPA is enabled and private app access fails, additionally verify that <tenant-name>.ebnpa.goskope.com:8090 is reachable.

Troubleshooting Common Enterprise Browser Issues

This guide covers the most frequently reported Enterprise Browser issues and their root causes. Use it to quickly diagnose and resolve problems before they require escalation.

Pages Not Loading (ERR_TIMED_OUT)

Users report that pages hang indefinitely or show “ERR_TIMED_OUT” / “This site can’t be reached.”

Root Cause

Enterprise Browser steers HTTPS traffic to the Netskope eproxy on port 8090. If the eproxy endpoint is unreachable, all browsing fails.

Resolution

1. Verify network connectivity to eproxy-<tenant>.goskope.com:8090 from the affected endpoint.
   
2. Check if a firewall, VPN, or network change is blocking port 8090 outbound.
   
3. Verify that the proxy bypass list does not contain wildcards that inadvertently bypass the proxy for all traffic (which would break steering).
   
4. If only specific sites fail, check whether an RTP policy is blocking the traffic — review the Netskope One admin console under SkopeIT > Events for block events matching the user and destination.
   
5. If the issue affects only one user, verify their license is active and their browser profile is correctly provisioned.
   

Enterprise Browser Does Not Start

The application does not open, crashes immediately after launch, or the window appears and closes.

Root Cause

Typical causes include:

• EDR/antivirus quarantining browser executables
  
• corrupted user profile data
  
• the browser attempting to use a profile that was deleted server-side
  

Resolution

1. Check your EDR/antivirus console for quarantine events related to Netskope Enterprise Browser.exe (Windows) or Netskope Enterprise Browser (macOS).
   
2. If the browser was working previously, try renaming the profile directory to force a fresh profile:
   • Windows: %LOCALAPPDATA%\Netskope\Browser\
     
   • macOS: ~/Library/Application Support/Netskope/Browser/
     
3. Reinstall Enterprise Browser using the latest installer (see the Updater Troubleshooting guide for download URLs).
   
4. On macOS Sequoia, verify that the browser is allowed under System Settings > Privacy & Security > App Management.
   

Website Works in Chrome but Not in Enterprise Browser

A specific website or web application functions correctly in Google Chrome or Microsoft Edge but fails or behaves differently in Enterprise Browser.

Root Cause

Enterprise Browser steers all HTTPS traffic through the Netskope Security Cloud. Certain web applications may:

• reject connections from the eproxy IP range (if the application uses IP-based allowlisting)
  
• fail TLS client certificate challenges (mTLS is not supported through the proxy)
  
• behave differently when specific request headers are present
  

Resolution

1. Check whether the application requires mTLS (client certificate authentication). If so, the application domain must be added to the SSL bypass list, as client certificates cannot traverse the TLS inspection proxy.
   
2. Verify that the application’s server-side IP allowlist includes Netskope NewEdge IP ranges for the tenant’s POP.
   
3. Add the application domain to the proxy bypass list if it cannot function through TLS inspection.
   
4. Check SkopeIT > Events for any RTP block events for that destination from the affected user.
   

Troubleshooting Authentication for the Enterprise Browser

Enterprise Browser authenticates users through SAML Forward Proxy, relying on your organization’s Identity Provider (IdP) to validate credentials before establishing a secure browsing session. When authentication fails, users experience login loops, stuck authentication pages, or “invalid license” errors. This guide helps administrators diagnose and resolve SAML errors, BrowserID failures, IdP configuration problems, and provider-specific issues with Microsoft Entra ID and Okta.

How Authentication Works

Enterprise Browser uses the Netskope SAML Forward Proxy to authenticate users. When a user opens Enterprise Browser for the first time or when their session expires, the browser redirects to the Netskope auth service (nsauth-<tenant-name>.goskope.com), which initiates a SAML flow with the configured IdP. After successful authentication, a session token is established and the user can browse normally through the Cloud Explicit Proxy (CEP).

This means:

• the IdP domains must be reachable from the browser (bypassed from proxy interception)
  
• the user must be assigned to the Netskope SAML application in the IdP
  
• the user must be provisioned via SCIM — manually created users are not supported
  
• the SAML NameID must use the user’s email address, not UPN or other identifiers
  

Diagnosing Authentication Loops

Symptoms

• browser redirects endlessly between nsauth-<tenant-name>.goskope.com, the IdP, and back
  
• authentication page loads repeatedly without completing
  
• user sees the IdP login page, enters credentials, but is never redirected back to browsing
  

Root Cause: Missing Bypass Domains

The most common cause of authentication loops is that IdP domains are not bypassed from proxy interception. Enterprise Browser routes all traffic through CEP. If the IdP domains are also routed through CEP, the SAML authentication flow cannot complete because the auth redirect itself gets intercepted.

Resolution Steps

1. In the Netskope One admin console, go to Settings > Security Cloud Platform > Enterprise Browser > Bypass Settings.
   
2. Verify that all required IdP domains are listed in the bypass configuration.
   
3. If the Netskope Client is also deployed on the device, verify that Enterprise Browser traffic is bypassed in the Client configuration (Certificate Pinned App exception). Without this, the Client may intercept EB traffic before it reaches CEP, causing a double-proxy scenario that breaks authentication.
   

Diagnosing SAML Forward Proxy Misconfiguration

Symptoms

• user is prompted by the IdP but Okta rejects the login with an error
  
• error message from IdP indicates “user not assigned” or “application not found”
  
• test SSO connection in the Netskope admin console fails
  

Resolution Steps

1. In the Netskope One admin console, go to Settings > Security Cloud Platform > Forward Proxy > SAML.
   
2. Verify the SAML account configuration:

• Access Method must include “Enterprise Browser” (or “All”)
  
• IDP SSO URL, IDP Entity ID, and IDP Certificate must match your IdP’s configuration exactly
  

3. In your IdP, verify the user (or their group) is assigned to the Netskope SAML application:

• Okta: Applications > Netskope User Enrollment > Assignments — confirm user or group is listed
  
• Microsoft Entra: Identity > Applications > Enterprise Applications > Netskope User Authentication > Users and groups — confirm assignment

4. Verify SCIM provisioning is active and the user is synced. Enterprise Browser only supports SCIM-provisioned users.

Diagnosing UPN and Email Mismatch (Microsoft Entra)

Symptoms

• authentication succeeds at the IdP level but Enterprise Browser does not recognize the user
  
• user can log in but group-based policies are not applied
  
• user appears authenticated but shows as a different identity in logs
  

Root Cause

Microsoft Entra can send either the User Principal Name (UPN) or the email address as the SAML NameID. Netskope uses email as the primary identifier for login, policy evaluation, and logging. If Entra sends the UPN but SCIM provisions by email, the identifiers do not match, causing policy and group mapping failures.

Resolution Steps

1. In Microsoft Entra, go to Identity > Applications > Enterprise Applications > Netskope User Authentication > Single sign-on.
   
2. Click Attributes & Claims.
   
3. Edit the Unique User Identifier (Name ID) claim.
   
4. Set the Source attribute to user.mail (not user.userprincipalname).

5. Click Save.

6. Verify that SCIM provisioning also uses the email address as the unique identifier.

Troubleshooting Enterprise Browser Update Issues

Enterprise Browser updates automatically in the background, similar to Google Chrome. However, updates can fail due to endpoint security software interference, orphaned registry keys, macOS permissions, or network connectivity issues. This guide helps administrators diagnose and resolve common update problems, including EDR false positives, stuck updates, and manual recovery paths.

Prerequisites

• Administrative access to affected endpoints (or MDM remote management)
  
• Access to the Netskope One admin console
  
• Network connectivity to nsbrowser-updates.<MP>.goskope.com (where <MP> is the tenant’s management plane region)

Understanding the Update Process

Enterprise Browser instances regularly check Netskope services for new versions. The process works as follows:

1. The NetskopeBrowserUpdater runs as a scheduled task (Windows) or background process (macOS).
   
2. It contacts nsbrowser-updates.<MP>.goskope.com to check for available updates.
   
3. If a new version is available, it downloads and installs it alongside the current version.
   
4. If the browser is not running, the update replaces the current version immediately.
   
5. If the browser is running, a relaunch notification appears (controlled by the RelaunchNotification policy).
   
6. After the relaunch window expires, the browser restarts automatically.
   

Diagnosing Stuck Updates

An update is “stuck” when Enterprise Browser remains on an old version despite newer versions being available. Use the following checklist to diagnose the issue.

Verifying the Current Version

In Enterprise Browser, go to netskope://version or Settings > About Enterprise Browser. Compare the installed version against the latest available version communicated in release notes.

Common Causes of Stuck Updates

The most common causes include:

• EDR/antivirus blocking the updater — the NetskopeBrowserUpdater process or its file writes are quarantined
  
• Orphaned registry keys (Windows) — leftover keys from a prior installation prevent the updater from recognizing available updates
  
• macOS App Management permissions — macOS Ventura and later require explicit permission for the updater to modify applications
  
• Network connectivity — the updater cannot reach nsbrowser-updates.<MP>.goskope.com
  
• Updater scheduled task missing (Windows) — the scheduled task was deleted or never created
  

Resolving EDR and Antivirus False Positives

Endpoint Detection and Response (EDR) tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, and others may block the Enterprise Browser installer or updater. This typically manifests as file permission errors, installation failures (exit code 1619), or updates that never complete.

Paths to Allowlist

Configure your EDR/antivirus to allow access to the following paths. Enterprise Browser supports both per-user and system-wide (per-machine) installations; allowlist the paths that match your deployment.

Windows — Per-User Installation (default):

• C:\Users\<USERNAME>\AppData\Local\Netskope\Browser\
  
• C:\Users\<USERNAME>\AppData\Local\Netskope\NetskopeBrowserUpdater\
  
• C:\Users\<USERNAME>\AppData\Local\Temp\ (during installation only)
  

Windows — System-Wide Installation (MSI via MDM):

• C:\Program Files (x86)\Netskope\NetskopeBrowserUpdater\
  
• C:\Program Files (x86)\Netskope\Browser\
  
• C:\Windows\Installer\ (during MSI execution only)
  

Windows Registry keys:

• HKCU\Software\Netskope\Update (per-user)
  
• HKLM\Software\Netskope\Update (system-wide)
  

macOS — Per-User Installation (default):

• ~/Library/Application Support/Netskope/NetskopeBrowserUpdater/
  
• ~/Library/Application Support/Netskope/Browser/
  
• /Applications/Netskope Enterprise Browser.app/
  

macOS — System-Wide Installation:

• /Library/Application Support/Netskope/NetskopeBrowserUpdater/
  
• /Library/Application Support/Netskope/Browser/
  
• /Applications/Netskope Enterprise Browser.app/
  

Processes to Allowlist

Add the following process names to your EDR exclusion list:

• NetskopeBrowserUpdater.exe (Windows)
  
• Netskope Enterprise Browser.exe (Windows)
  
• NetskopeBrowserUpdater (macOS)
  
• Netskope Enterprise Browser (macOS)
  
• com.netskope.NetskopeBrowserUpdater (macOS — bundle identifier for App Management)
  

CrowdStrike Falcon Specific Guidance

In the CrowdStrike Falcon console, create a Machine Learning exclusion or IOA exclusion for the paths above. If CrowdStrike is running in EDR-only mode (without Falcon Prevent), ensure the file access policies do not block the Netskope updater process from writing to the AppData\Local\Netskope\ directory.

Resolving macOS Update Permissions Issues

On macOS Ventura (13) and later, the operating system requires explicit user or MDM approval for applications to modify other applications. The NetskopeBrowserUpdater needs this permission to apply updates.

Symptoms

Users see an error: “NetskopeBrowserUpdater was prevented from modifying apps on this Mac.”

Resolution (Manual)

1. On the Mac, go to System Settings > Privacy & Security > App Management.
   
2. Find NetskopeBrowserUpdater in the list and toggle it to Allow.
   
3. On macOS Sequoia, also verify under System Settings > General > Login Items & Extensions that the Netskope extensions are enabled under both Allow in the Background and Endpoint Security Extensions.
   
4. Restart the Mac if the change does not take effect immediately.
   

Resolution (MDM)

Deploy a configuration profile (.mobileconfig) that pre-approves the NetskopeBrowserUpdater bundle identifier for App Management permissions. This prevents the user from needing to manually approve the permission.

Resolving “No Update Is Available” Error (Windows)

This error appears when orphaned Windows Registry keys from a previous installation cause the updater to believe Enterprise Browser is already installed or up to date.

Full Cleanup Procedure

1. Close Enterprise Browser completely.
   
2. Open regedit.exe and delete the following keys:
   • HKCU\Software\Netskope\Update
     
   • HKCU\Software\Netskope\Browser (all browser-related subkeys)
     
3. Delete the following directories:
   • %LOCALAPPDATA%\Netskope\Browser\
     
   • %LOCALAPPDATA%\Netskope\NetskopeBrowserUpdater\
     
   • Any shortcuts in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Netskope\
     
4. Open Task Scheduler and remove any Netskope-related scheduled tasks if present.
   
5. Reboot the device.
   
6. Re-download the installer from the email invitation link or use the direct download URL.
   
7. Run the installer as a standard user (do not use “Run as Administrator” — the per-user installer fails when run with elevated privileges).
   
8. Verify the new version appears in netskope://version.
   

Reinstalling Over an Existing Installation

Running the latest installer over an existing installation upgrades it in place. The user’s profile, bookmarks, and configuration are preserved. No uninstall is required before reinstalling.

MDM-Driven Update

For large-scale remediation, deploy the latest MSI package through your MDM tool (Intune, JAMF, SCCM, or similar) with the same parameters used for the original deployment. The MSI installer handles upgrades automatically.

Verifying Update Health Across the Fleet

To confirm that updates are working correctly across your deployment:

• Check user versions in the Netskope One admin console under the Enterprise Browser user list. Users on old versions indicate update failures.
  
• Check the Windows Registry on affected machines: HKCU\Software\Netskope\Update\LastInstallerError contains the exit code from the last installation attempt.
  
• Check macOS system logs using Console.app, filtering for “NetskopeBrowserUpdater” to see permission or download errors.
  

Exit Code Reference (Windows)

Exit Code	Description	Common Cause
0	Success	Installation or update completed
1602	User canceled	Interrupted by user or process
1603	Fatal error	Profile creation failed (MDM), invalid license, or connectivity issue
1619	Package open failed	EDR/antivirus blocking file access
1638	Version conflict	Old version exists; perform full cleanup then reinstall

Considerations

Considerations include:

• the per-user installer (.exe) must be run without elevated privileges; running as Administrator causes installation failures
  
• macOS App Management permissions cannot be silently granted without an MDM configuration profile
  
• network access to nsbrowser-updates.<MP>.goskope.com must not be blocked by proxy, firewall, or DNS policies
  
• the RelaunchNotificationPeriod (default: 7 days) controls how long users can defer updates before forced restart — reducing this value accelerates update adoption but may disrupt users
  
• if CrowdStrike Falcon or another EDR quarantines the updater binary, the scheduled task continues to run but silently fails on each execution

Performance Issues

This page covers common performance problems in Netskope Enterprise Browser and how to resolve them.

Slow Page Loading

Symptoms: Pages take longer to load than expected in Enterprise Browser compared to other browsers.

Cause: Enterprise Browser steers traffic through the Netskope secure proxy (eproxy-<tenant-name>.goskope.com:8090) for policy evaluation. Latency between the device and the Netskope PoP (point of presence) can affect page load times.

Resolution:

1. Check that the device is connecting to the nearest Netskope PoP. Your Netskope account team can confirm which PoP handles your tenant traffic.
   
2. Verify that corporate network routing policies are not forcing traffic to a distant proxy before it reaches Netskope.
   
3. Ensure all required Netskope endpoints are reachable directly without intermediate proxies (see System Requirements).
   
4. If your environment uses split tunneling with the Netskope Client, verify that Enterprise Browser traffic is handled correctly.
   

High CPU or Memory Usage

Symptoms: Enterprise Browser uses significantly more CPU or memory than expected, causing device slowdowns.

Cause: Multiple open tabs with active Browser Protection Policies (such as Data Masking or Watermarking) may increase CPU and memory usage compared to an unmanaged browser. Data Masking in particular performs DOM inspection on page load.

Resolution:

1. Check for tabs with resource-intensive applications (for example, video conferencing, online spreadsheets with large datasets) alongside active Browser Protection Policies. Close unused tabs.
   
2. If Data Masking is enabled on heavily dynamic pages (for example, single-page applications with frequent data updates), review whether the policy scope can be narrowed to reduce the number of pages affected.
   
3. Ensure the device meets the minimum hardware requirements: modern x64 or ARM processor, Windows 10+ or macOS 12+.
   

Browser Does Not Connect

Symptoms: Enterprise Browser launches but cannot load any pages, or shows a connection error.

Cause: The browser cannot reach the Netskope proxy or configuration service.

Resolution:

1. Verify that the device has internet connectivity.
   
2. Confirm that the required Netskope endpoints are accessible from the device’s network (see System Requirements for the full list).
   
3. If the device is behind a corporate firewall or proxy, ensure that Netskope’s endpoints are whitelisted for direct access.
   

Encrypted Downloads Are Slow

Symptoms: File downloads with the ENCRYPT policy action take significantly longer than unencrypted downloads.

Cause: Encryption is applied on-the-fly as the file is downloaded. Very large files may take additional time to process.

Resolution:

1. Verify that the download is completing (not stalled). If the download appears stuck, try navigating away and re-initiating the download.
   
2. Review whether the ENCRYPT policy needs to apply to all files on the destination, or only specific high-risk content. Narrowing the policy scope reduces the number of files that require encryption.
   

Policy Not Being Applied

Symptoms: Browser Protection Policies configured in the admin console do not appear to take effect.

Resolution:

1. In Enterprise Browser, navigate to netskope://policy and verify that the policy appears in the list.
   
2. If the policy is not listed, force a manual sync by navigating to netskope://policy and waiting for the sync confirmation. Automatic sync runs every 20 minutes.
   
3. Confirm that the device is correctly enrolled and connected to your tenant. Check the user’s device list in the Netskope console.
   
4. Verify that the policy criteria (destination, user scope) match the page where the policy should apply.
   

To learn more: System Requirements | Compatibility Notes | Enterprise Browser Installation and Troubleshooting