Uninstalling the Netskope Client

This section describes various options to uninstall Netskope Client from the end-user devices.

Client uninstallation does not automatically remove tenant certificates. For more related details, reach out to Netskope support.

Windows

Option 1

Option 2

Use the Add or Remove Programs option in the Windows control panel to uninstall the Client.

Microsoft Endpoint Configuration Manager

@echo off
REM ---------------------------------------------------------------
REM Improved Uninstall Netskope Client (Password Protected)
REM Uses PowerShell to read registry and extract MSI GUID
REM ---------------------------------------------------------------

setlocal

set "LOGFILE=%PUBLIC%\nscuninstall.log"
set "PASSWORD=<password>"

echo Searching for Netskope Client...

powershell -NoLogo -NoProfile -Command ^
    "$apps = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -eq 'Netskope Client' };" ^
    "if (-not $apps) { Write-Host 'Netskope Client not found.'; exit 1 };" ^
    "$success = $false;" ^
    "foreach ($app in $apps) {" ^
    "    Write-Host 'Found:' $($app.DisplayName);" ^
    "    if ($app.UninstallString -and $app.UninstallString -match '\{[A-F0-9\-]+\}') {" ^
    "        $guid = $matches[0];" ^
    "        Write-Host \"Uninstalling $($app.DisplayName) with GUID: $guid\";" ^
    "        try {" ^
    "            Start-Process msiexec.exe -ArgumentList \"/x $guid PASSWORD=`\"%PASSWORD%`\" /qn /l*v `\"%LOGFILE%`\"\" -Wait -PassThru | Out-Null;" ^
    "            Write-Host 'Uninstall completed for:' $($app.DisplayName);" ^
    "            $success = $true;" ^
    "        } catch {" ^
    "            Write-Error \"Failed to uninstall $($app.DisplayName): $_\";" ^
    "            exit 2;" ^
    "        }" ^
    "    } else {" ^
    "        Write-Host 'No MSI GUID found for:' $($app.DisplayName);" ^
    "    }" ^
    "};" ^
    "if (-not $success) { exit 2 } else { exit 0 }"

set "ec=%ERRORLEVEL%"

if %ec%==0 (
    echo Uninstallation completed successfully.
) else if %ec%==1 (
    echo Netskope Client not found.
) else (
    echo Uninstallation failed. Check the log file: %LOGFILE%.
)

endlocal
exit /b

– You can also save this script as a .bat file and execute it locally from Windows Command Prompt.
– This script works only in Admin mode.

Microsoft Group Policy Object(GPO)

Uninstalling can be done through GPO using a batch script similar to installation. Use the following uninstallation script (works only in admin mode):

Get-WmiObject Win32_Product | Where-Object Name -eq "Netskope Client" | % { $_.Uninstall() }

To uninstall NS Client with Password Protection using GPO Batch Script use the following uninstallation script:

@echo off
SetLocal
    set newver=117.0.0.2087
    set newVernum=%newver:.=%
for /f "tokens=2 delims==" %%f in ('wmic product where "Name like 'Netskope Client'"
get Version /value ^| find "="') do set "instVer=%%f"
IF NOT DEFINED instVer (
    msiexec /x "<path_to_file>/STAgent.msi" PASSWORD=<uninstall_password_set_in_tenant>! /q 
) ELSE (
    set instVerNum=%instVer:.=%
    IF instVerNum LSS newVernum (
        msiexec /x "<path_to_file>/STAgent.msi" PASSWORD=<uninstall_password_set_in_tenant>! /q
    )
)
EndLocal

macOS

The following options list the steps to uninstall Netskope Client in your macOS device:

Option 1

Option 2

Option 3

This option describes how to manually run the Remove Netskope Client application from the device’s Applications folder to begin the uninstall process.

Go to Applications and click the Remove Netskope Client icon.
Enter your credentials to proceed with the uninstallation of the client.

When uninstalling Netskope Client on devices running Big Sur (macOS 11), users are prompted to enter their credentials twice to uninstall the Network extension app proxy and to remove the Netskope client.

This option includes a script to launch the Remove Netskope Client application and begin the uninstall process.

Create a shell script (for example, uninstall.sh) using the following command and execute it on the user’s device to uninstall the Client.

#!bin/bash
/Applications/Remove\ Netskope\ Client.app/Contents/MacOS/Remove\ Netskope\ Client uninstall_me exit

To uninstall using a password, use the following command:

#!/usr/bin/env bash
UNINSTALL_PASSWORD='password'
/Applications/Remove\ Netskope\ Client.app/Contents/MacOS/Remove\ Netskope\ Client uninstall_me $UNINSTALL_PASSWORD

Ensure to add a blank space before Netskope and Client in this script.

The following section provides the instructions to uninstall the Netskope Client using various MDMs.

Netskope provides an uninstallation script as a part of JAMFScripts.zip that can be used across MDMs. JAMFScripts.zip is available for download from the Scripts section in Netskope Support portal. Extract JAMFScripts.zip to find the uninstallation script “jamfuninstall.sh”. This downloads JAMFScript_v22_Nov2024 that contains two files:

jamfuninstall.sh – Use this file for uninstallation.
nsclientconfig.sh

When using this script for uninstalling, enter your password as the fourth parameter in the script in the JAMF policy using the set command below:

set -- 0 0 0 <yourUninstallPassword>

– Auto-removal of extensions is currently supported only from release 95.1.2 onwards and not for versions prior to 95.1.2. However, when creating profiles in JAMF, selecting the Removable System Extension option under the System Extension Type option will prevent user approval requests during manual Client un-installation. This is applicable for macOS Monterey (version 12) and later.
– Setting the System Extension to Removable results in the extension unloading and the Netskope client disables as a result. To ensure proper execution, you must configure your MDM to make the System Extension Removable and then run the uninstall script.
– It is recommended that you create a separate configuration profile and script for the uninstallation for specific machines or users as required. Changing the existing configuration profile for the system extension will result in clients disabling and users receiving requests for manual approval.

Jamf

This section describes the steps to uninstall Netskope Client in macOS devices using Jamf.

Configuration Profile and Policy

Perform the following instructions to mark the system extension as removable:

In JAMF, go to Computers > Configuration Profiles > New.
Provide a Name for the Configuration Profile.
Select System Extensions > Configure.
Select Allow users to approve system extensions.
Under Allowed Team IDs and System Extensions, select System Extension Types as Removable System Extensions.
Add Network Extension Team ID: 24W52P9M7W
Click Add to include the following System Extension: com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy
Click Save under Removable System Extensions.
Click Save in the bottom right to save the Configuration Profile.

Once the Configuration Profile is configured, you must upload and configure the uninstall script in a Policy. Refer to Scripts for instructions to add a script. After you upload the script:

Go to Computers > Policies > New.
Give the Policy a name.
Select Login for the trigger and the frequency as Once per computer. You can optionally configure a different trigger if you’d like the script to run sooner or at a different interval.
Click Scripts > Configure.
Click Add on the uninstall script you uploaded.
Click Save.

You can now assign the Configuration Profile and Policy to users and computers in JAMF. It is recommended to use a Smart Group or ensure you remove users and computers from the Configuration Profile and Policy that are configured to install the client.

Intune

This section describes the steps to uninstall Netskope Client in macOS devices using Intune.

Create Configuration Profile

Perform the following instructions to mark the system extension as removable:

In Intune, go to Devices > macOS > Configuration Profiles > Create > New Policy.
Select macOS under Platform and Settings catalog under Profile Type.
Click Create.
Under Basics, provide a name for the profile.
Click Next.
Under Configuration Settings, click +Add settings.
In the Settings Picker window, select System Configuration > System Extensions.
Select the checkbox for Removable System Extensions.
Go to Configuration Settings on the left-pane and click +Edit Instance.
Enter the following:
- Removable System Extensions name: com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy
- Team Identifier: 24W52P9M7W
Click Save.
Click Next to continue.
Provide Scope tags(optional).
Click Next to continue.
In Assignment, Add user or device assignments to uninstall the Netskope client.
Click Next to continue.
In Review+Create, you can review the policy configurations.
Click Create.

Run Uninstall Script

Once the Removable System Extension policy is configured, you must upload and configure the uninstall script. Refer to Shell Scripts for instructions to add a script. Intune does not support passing parameters to the script and hence you must add a set command to the script.

Perform the following instructions to run the uninstall script:
1. In Intune, go to Devices > macOS > Shell scripts.
2. Click +Add.
3. In Basics, enter a Name and Description.
4. Click Next.
5. In Script Settings, select to upload the uninstall script from your local storage in your computer. Make the following changes:
  - Run script as signed-in user – No
  - Hide script notifications on devices – Not configured
  - Script frequency – Not configured
  - Max number of times to retry if script fails – Not configured
    
    Selecting Not Configured for all other parameters implies that the script runs only once.
    
    Include set -- 0 0 0 <yourUninstallPassword> in the script to unsintall using password parameter.
6. Click Next.
7. Assign proper groups based on user or Devices by clicking Add groups and checking the box next to the appropriate groups.
8. Click Select.
9. Click Next to continue.
10. Click Add.

Iru (Formerly Kandji)

Kandji does not support marking system extensions as removable. The steps provided for the Netskope install allow for any extension type from the Netskope team identifier.

Perform the following instructions to run the uninstall script:

In Kandji, go to Library.
Click +Add new.
Click Custom Scripts > Add & Configure.
Select the Blueprint you want to uninstall clients.
In ExecutionFrequency, select the option: Run once per device.

Enter the following script in the Audit Script text box:

#!/bin/bash
#script for installing NSAgent on OSX machines
#will check to see if Netskope is Installed
function Test_NSClient(){
xz=$(/usr/bin/mdfind kMDItemFSName == Netskope Client.app -onlyin /Library/Application\ Support/)
if [ -e "$xz" ]; then
    echo "$xz found netskope client is installed"
exit 1
else
    echo "client does not exist"
exit 0
fi
}
Test_NSClient
#end script

Click +Add Remediation Script.

Download “kandji_uninstall.sh” script from the Support portal.
Paste the contents of the uninstall script in the Remediation Script field.
Click Save.

Omnissa Workspace One

This section describes the steps to uninstall Netskope Client for macOS devices using Omnissa Workspace One.

Add Removable System Extension

Omnissa Workspace One supports Removable System Extensions and smart groups with exclusions. Perform the following instructions to mark the system extension as removable:

Go to Resources > Profiles & Baselines > Profiles.
Click Add.
Click Add Profile from the Add dropdown options.
Select Apple macOS from the platform list.
Select Device Profile in Select Context.
Provide a name for the profile.
Start typing ‘System’ in the search text box of the configuration profile.
Expand System Extensions option and click Add.
Configure Removable System Extensions as follows:
- Team Identifier: 24W52P9M7W
- Bundle Identifier: com.netskope.client.Netskope-Client.NetskopeClientMacAppProxy
Click Next.
Assign the profile to a Smart Group and necessary exclusions. This structure will depend on your environment.
Click SAVE & PUBLISH.

Run Uninstall Script

Once the Removable System Extension policy is configured, you must upload and configure the uninstall script. Follow the steps below to use the Scripts functionality of Omnissa WorkSpace One. Omnissa WorkSpace One also supports Files/Actions which allows for more granular scheduling based on specific triggers such as Logon or recurring checking.
1. Go to Resources > Scripts.
2. Click ADD > macOS.
3. In General, provide a Name for the uninstall script.
4. Click NEXT.
5. Click UPLOAD and select the file you have configured with the uninstall password.
6. Click NEXT.
7. Click SAVE.
8. Select the script that you previously uploaded and click ASSIGN.
9. Click NEW ASSIGNMENT.
10. Enter a name for the Assignment.
11. Select a SmartGroup for uninstall based on the devices or users that need the client uninstalled.
12. Click NEXT.
13. Select the deployment trigger. You can select Run Once Immediately if you want the script to push immediately.
14. Click ADD.

Linux

Use the command sudo /opt/netskope/stagent/uninstall.sh to uninstall Netskope Client in Linux.