PowerShell · v3.4-EU

Allowlist & Proxy Connectivity Test

A PowerShell script that checks in one run whether a Windows device can reach every NinjaOne endpoint in the EU region – directly or through a proxy. It also checks the agent service and whether the device has internet access at all.

View on GitHub

What the script checks

Every EU endpoint

Tests every endpoint from the NinjaOne Dojo allowlist articles (Global + EU region): DNS, TCP connect to every IP, TLS 1.2 handshake and UDP 40000 for NinjaOne Remote.

Proxy detection per URL

Detects the proxy automatically (agent registry, NC_PROXY, WinINET, PAC, WinHTTP, environment variables) and shows per URL whether the proxy lets it through or blocks it.

SSL inspection & legacy IPs

Detects SSL inspection by firewall or proxy, legacy NinjaOne Remote IPs in IP-based allowlists, and broken proxy registry values.

Agent service & internet

Checks the NinjaRMMAgent service (not installed / stopped / running), restarts it if needed, and checks gateway, ping, DNS and TCP/443 – an adapter being up does not mean the device has internet.

When to use it

When to use it
Situation	What the test tells you
Agent shows offline in NinjaOne	Is the service running, does the device have internet, which endpoint is blocked?
Rolling out NinjaOne at a new customer	Does the firewall/proxy permit everything – before the agent is installed?
NinjaOne Remote does not connect	Are TCP 443/7075 and UDP 40000 open, are the static Remote IPs permitted, is SSL inspection active?
Customer uses a proxy	Does the proxy permit each URL, or does it block with 403/407? Is the agent proxy configured correctly?
Firewall allowlists by IP	Do the NinjaOne Remote hosts still resolve to legacy IPs that are being retired?
“LAN/WLAN is connected, but nothing works”	Gateway, ping, DNS and TCP/443 show whether the device actually reaches the internet.

Requirements

Windows PowerShell 5.1 or PowerShell 7+
Windows 10 / 11 or Windows Server 2016+ (the service check and scheduled task need Windows)
Administrator or SYSTEM rights for the service start/restart – everything else also works without them
No modules, no internet downloads, no NinjaOne API access

Instructions

Option A: Run manually on the device

Use this when the agent is offline or not installed yet – then you cannot run the script through NinjaOne.

1
Download the script and copy it to the device, for example to C:\Temp.
2
Open PowerShell as administrator.

Allow the script for this session only and run it:

PowerShell

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass
C:\Temp\Ninja_Allowlist_Test_EU.ps1

4
Optional: save the results as CSV for the customer or the firewall team:
PowerShell
```
C:\Temp\Ninja_Allowlist_Test_EU.ps1 -ExportCsv C:\Temp\ninja-allowlist.csv
```

Tip: when run manually in the user's session, the WinINET/PAC proxy of the logged-in user is detected – useful if the customer's browser uses a proxy.

Option B: Run through NinjaOne

Use this when the agent is online – the script then runs as SYSTEM directly on the device.

1
Administration → Library → Automation → Add → New Script.
2
Name: NinjaOne Allowlist Test (EU).
3
Language PowerShell, operating system Windows, architecture All, run as System.
4
Paste the content of Ninja_Allowlist_Test_EU.ps1 (copy it from GitHub – button below).
5
Open the device → Run → pick the script. Enter parameters in the “Parameters” field if needed, for example:
“Parameters” field
```
-Mode Both -AllShards
```
6
Check the output in the activity log of the device.

The script runs as SYSTEM: HKCU settings (WinINET, PAC) belong to the SYSTEM account, not to the logged-in user.
The agent restart is deferred by 90 seconds, so the device is briefly offline shortly after the script finishes. That is expected.
If the script has critical failures, it exits with code 1 and NinjaOne marks the run as failed.
Use -NoServiceRestart if you only want the report without restarting the agent.

Parameters

Parameters
Parameter	Default	Description
`-Mode`	`Auto`	Auto = use the proxy if one is detected, otherwise direct. Also Direct, Proxy, or Both (compare both paths).
`-ProxyHost`	`–`	Set the proxy manually instead of detecting it.
`-ProxyPort`	`–`	Port of the manual proxy.
`-ProxyType`	`Http`	Http, Https (TLS to the proxy) or Socks5.
`-ProxyUser / -ProxyPassword`	`–`	Proxy credentials. Override the (masked) registry credentials.
`-Timeout`	`5000`	Timeout per connection attempt in ms.
`-AllShards`	`off`	Test all 40 WebSocket shards instead of a sample.
`-IncludeBackup`	`off`	Also test the Device Backup endpoints.
`-IncludeCloudRdp`	`off`	Also test the Cloud RDP endpoints.
`-IncludeIPv6`	`off`	Also test AAAA records (IPv6).
`-SkipUdp`	`off`	Skip the UDP checks.
`-ExportCsv`	`–`	Path for a CSV export of all results.
`-NoServiceRestart`	`off`	Only report the agent service state, do not start/restart it.

Examples

Standard test, proxy detected automatically:

PowerShell

.\Ninja_Allowlist_Test_EU.ps1

Compare the direct path and the proxy path:

PowerShell

.\Ninja_Allowlist_Test_EU.ps1 -Mode Both

Test a specific proxy with credentials:

PowerShell

.\Ninja_Allowlist_Test_EU.ps1 -Mode Proxy -ProxyHost 192.168.32.144 -ProxyPort 3128 -ProxyUser svc-ninja -ProxyPassword '********'

Full test including backup, all shards and CSV – without touching the agent:

PowerShell

.\Ninja_Allowlist_Test_EU.ps1 -AllShards -IncludeBackup -NoServiceRestart -ExportCsv C:\Temp\ninja.csv

Reading the output

[OK]

Check passed.

[FAIL]

Check failed. Critical failures cause exit code 1.

[WARN]

Worth a look, but not blocking – e.g. fallback port 7075, SSL inspection, legacy IP.

[INFO]

Information only – configuration, UDP results, adapters.

Exit code 0 = no critical failures, 1 = at least one critical failure. At the end, a summary lists passed checks, warnings, critical failures per endpoint and notes (internet, agent service, legacy IPs, SSL inspection, proxy).

Troubleshooting

Troubleshooting
Result	Cause	What to do
`Service 'NinjaRMMAgent' not found`	Agent not installed	Install the agent. The allowlist results still tell you if the network is ready.
`Service is started but stops again`	Agent crashes or cannot start	Check the Windows event log and C:\ProgramData\NinjaRMMAgent\logs, reinstall the agent if needed.
`Not running elevated`	PowerShell not started as admin	Start PowerShell as administrator or run it through NinjaOne as System.
`no internet`	Uplink, gateway, firewall or captive portal	Fix the network first; the allowlist failures are a result of this.
`DNS resolves (internal resolver), but the internet is not reachable`	Internal DNS works, outbound traffic is blocked	Check the default route and firewall; a proxy may be required.
`DNS resolution failed`	DNS filter or split DNS	Allow .ninjarmm.com and .ninjarmm.net in the DNS filter.
`TCP/443 blocked or unreachable`	Firewall drops the connection	Add the endpoint to the firewall allowlist.
`unexpected issuer -> SSL inspection likely`	Firewall/proxy intercepts TLS	Exclude NinjaOne URLs from SSL inspection.
`resolves to a LEGACY IP`	IP-based allowlist with old Remote IPs	Add the documented static IPs; not needed if you allowlist by URL.
`proxy replied: ... 407`	Proxy requires authentication	Pass -ProxyUser / -ProxyPassword (the registry password is masked).
`proxy replied: ... 403`	Proxy blocks the URL	Add the URL to the proxy allowlist.
`proxy replied: ... 502/504`	Proxy cannot reach the target	Check the upstream firewall behind the proxy.
`CONNECT/7075 fails via HTTP proxy`	HTTP proxies usually permit CONNECT on 443 only	Expected. Open 7075 directly on the firewall or use SOCKS5.
`ProxyHost is set but ProxyPort is missing`	Incomplete agent proxy registry	Add ProxyPort as DWORD (32-bit).
`agent uses a proxy but NC_PROXY is not set`	NinjaOne Remote ignores the proxy	Set NC_PROXY as a system environment variable.
`Aborting: proxy tests are meaningless without a reachable proxy`	Proxy host/port wrong or blocked	Check the proxy address, or use -Mode Both to also test direct.

Limitations

UDP cannot be proven open without a responder. UDP results are only INFO/WARN, never OK.
Static IP validation only runs in Direct/Both mode, because in proxy mode the proxy resolves DNS.
IP gateways cannot be tested through an HTTP proxy.
PAC files are detected but not evaluated per URL; review their rules for ninjarmm.com / ninjarmm.net manually.
Wildcards (*.ninjarmm.com, *.ninjarmm.net, *.rmmservice.eu, *.ingest.sentry.io), CloudFront and OS patch sources are not tested.
The internet check uses public resolvers (Cloudflare, Google, Quad9). Networks that block all of them and have no proxy are reported as having no internet.
The endpoint list reflects the Dojo articles as of 2026-08-17. Check the current articles if results do not match.

The script

The full source code lives on GitHub – you will also find the latest version there.

Ninja_Allowlist_Test_EU.ps1

PowerShell · v3.4-EU

View on GitHub