SHADOW

Back up, compare and manage NinjaOne scripts, policies and custom fields, with GitHub, Azure DevOps or Bitbucket sync.

SHADOW is a browser extension for NinjaOne administrators. It adds backup, comparison, bulk-management and reporting tools directly inside the NinjaOne web console, and connects to your own private Git repository (GitHub, Azure DevOps or Bitbucket) for version control and change auditing. Disclaimer: This is a private, independent project and is in no way officially affiliated with, endorsed by, or sponsored by NinjaOne, Inc. "NinjaOne" is used only to describe compatibility. IMPORTANT TO KNOW SHADOW talks to the same internal web-app endpoints that the NinjaOne web interface itself uses, not to a published public API. NinjaOne can change or remove these endpoints at any time, which may temporarily break individual SHADOW features until an update is released. Use at your own risk and keep the extension up to date. SHADOW has no server of its own. All data stays between your browser, your NinjaOne tenant and the Git repository you configure. No analytics, no tracking, no remote code. WHO IS IT FOR - NinjaOne administrators with multiple tenants or environments - IT teams and MSPs that keep scripts and policies under version control - Anyone who wants a fast, reliable and auditable workflow for automation content in NinjaOne SCRIPT AND GIT AUTOMATION - Download Scripts: export your entire script library as PowerShell packages or as raw JSON archives with SHA-validated payloads, for compliance, cold storage or tenant migrations. - Import Scripts from JSON: queue any number of SHADOW exports for re-import. Valid source categories are preserved, unsupported languages are skipped, and backup guardrails are respected. - Compare with GitHub and Compare with Azure DevOps: a full-screen diff overlay that progressively loads your whole library, highlights status buckets, filters results, previews inline diffs and queues uploads per detected language. Apply selected changes from the repository back into NinjaOne, or upload selected scripts to the repository. - Import from GitHub: browse the connected repository inside the console, select the scripts you want, choose a destination category (or keep the source categories) and import them in bulk with progress feedback. - Script Usage: one overlay that shows where each script runs across policies, scheduled tasks and system tray configurations, and flags scripts that are not referenced anywhere so you can retire them safely. Optionally includes device-level policy overrides. - Script Manager: list every script (metadata only) and organize the library in bulk. Filter the list, bulk add or remove categories, optionally rename scripts and edit descriptions inline, and add or update script variables across a selection of scripts. TEMPLATE LIBRARY - Compare Templates: analyse your environment against the official NinjaOne Template Library, review the remediation list and apply or skip updates with confirmation prompts. - Import from Public GitHub (ShadowGitSync): keep individual scripts aligned with a third-party GitHub source by storing a raw URL in the script description. A preview-first overlay shows Up to date, Changed or Error status with side-by-side diffs and applies code-only updates. Names, categories, parameters and language settings are preserved, and you can choose to back up first. - Import from Private GitHub: browse your token-authenticated private repository from the Template Library page, multi-select scripts and import them in bulk. AD-HOC SCRIPT EXECUTION - Run Script Now: from Device Search or a device page, paste a PowerShell script and run it once on selected Windows devices without saving it to your script library. A step-by-step wizard covers target selection, script input and a final review. The script is executed by NinjaOne on the selected endpoints, never inside your browser. Access can be restricted to sysadmins. CUSTOM FIELDS AND METADATA - Export and Import for device, organization and location custom fields, with per-file validation and backup enforcement. Move definitions between tenants and keep them consistent. - Custom Field Manager: one filterable table of every custom field in a scope, with inline editing of Technician, Script and API permissions plus description, footer and tooltip text. Changes are submitted as throttled, MFA-aware writes. - Custom Field Usage (Reporting page): scan all script code for custom-field reads and writes and cross-reference them with the defined fields, including system fields. Shows which scripts and devices use each field, defined-but-unused fields, used-but-undefined names and permission conflicts. Results can be exported. - Bulk Set Values (organizations): set custom field values across all or selected organizations at once, either by entering a value or by copying from a source organization. Only the chosen fields are written, and there is an "only where empty" option. POLICY, BACKUP AND COMPLIANCE - Backup Now: run a full backup from the System Dashboard covering scripts, policies, custom fields and a technician permissions snapshot (each individually selectable). Uses automatic path sanitisation and rate-limited writes to GitHub, Azure DevOps or Bitbucket, or saves a local ZIP when "force local backup" is enabled. A running backup can be cancelled. - Auto Backup: automatically runs a full backup at startup when the last backup is older than a threshold you choose. - Backup Security Overlay: shows when backups were completed and can require a same-day backup before any script or field import proceeds. - Bulk Policy Assignment: apply a monitoring policy to a selected device role across every organization at once, with progressive loading and real-time success and error reporting. - Download Policies (JSON): export every policy as a JSON ZIP grouped by device class. - Compare Policies with GitHub or Azure DevOps: a structural, field-by-field diff between live policies and their backed-up copies, with per-policy detail, search, filters and bulk upload. Uploads only ever write to the repository, never back into NinjaOne. - Settings Audit (Device Search): audit effective device settings across your tenant, such as NinjaRemote confirmation, see the effective value and where it comes from (organization default or override), check devices against rules, export findings to CSV and reset selected devices to the organization default. REPORTING - Policy Report: structured policy documentation with selectable sections and PDF-friendly output. - Policy Override Audit: see inherited versus overridden values across a policy tree and, optionally, its devices. - Asset Report: asset lifecycle view based on warranty age, highlighting old or unknown devices, with per-organization PDF output. - Fleet Health Report: tenant-wide and per-organization scorecard covering device health, patching, vulnerabilities, backup failures and alerts. - Automation Usage Report: which automations ran over a date range, how often, and with what success or failure counts, plus queued automations, links to the affected device dashboards and a client-ready executive summary. Runs only when you click Run. - Technician Permissions Report: role-by-permission matrix with role comparison, snapshots stored in your repository and a view of changes between runs. - Activities Report: filter the tenant activity log by date range, multiple activity types and description text at the same time, with links to device dashboards. Runs only when you click Run. - Most reports include hover explanations and can be exported, including as PDF. CLOUD MONITOR TOOLS - Clone an existing Cloud Monitor, or build a new one, for a list of new IP addresses in one throttled batch, or move existing Cloud Monitors to another organization and location in bulk. IT ASSET MANAGEMENT (ITAM) TEMPLATES - Add Unmanaged Devices: curated parent and child role templates grouped by technology stack, with icon matching against your tenant and automatic batching, countdown pauses and resume prompts that avoid MFA lockouts. - Import and Export Unmanaged Devices: reproduce role structures in new tenants from JSON, or export your current definitions for audits, change reviews or sharing. ROLE-BASED ACCESS CONTROL - A sysadmin-only settings overlay (under Security Settings) lets you choose which SHADOW features other technicians may use. Anything not explicitly allowed stays sysadmin-only. Settings are stored inside your own NinjaOne tenant, and every restricted feature re-checks the technician's sysadmin status before it runs. SECURITY AND PRIVACY - GitHub, Azure DevOps and Bitbucket tokens are stored AES-GCM encrypted in the extension's local storage and are only decrypted inside the background service worker, never exposed to the NinjaOne page. - Messages to the token-handling background code are authenticated, so other scripts on the page cannot trigger them. Credentials are only available to trusted extension pages, and repository targets are pinned to your saved settings. - All inputs (repository names, folders, file paths) are validated and sanitised, runtime messages have size and count limits, remote downloads are capped at 10 MB, and object names and error text are HTML-escaped before display. - Requests only go to your NinjaOne tenant and to the repository provider you configure. SHADOW does not collect, sell or share personal data and has no developer-operated backend. - Works with NinjaOne instances worldwide, including Europe, Canada, Australia and US Federal. GETTING STARTED 1. Install SHADOW and open your NinjaOne console in Chrome. SHADOW buttons appear on the relevant pages, and a flyout menu appears at the bottom left. 2. Optional: create a private repository on GitHub, Azure DevOps or Bitbucket, create an access token with the minimum permissions (for GitHub a fine-grained token with Contents: Read and Write on a single repository is recommended), and enter the details in the SHADOW popup. 3. Click Test Connection, save, and run Backup Now from the System Dashboard. A step-by-step setup guide, release notes and privacy policy are available on the project page: https://github.com/AdvanceYourIT/SHADOW Support and feedback: open an issue on GitHub or join the Discord community linked from the project page. SHADOW is also available for Microsoft Edge. Disclaimer: This is a private, independent project and is in no way officially affiliated with, endorsed by, or sponsored by NinjaOne, Inc. Use at your own risk.