On-prem Active Directory & Exchange

​

How it works

• Direct execution — The RMM agent is installed on the target server (e.g., the Domain Controller or Exchange server). Neo runs scripts directly on it.
• Remote execution — The target server doesn’t have an RMM agent. Neo runs scripts on a “runner” VM that does have RMM, and uses PowerShell Remoting to reach the target server.

​

Setup

​

1. Configure Company Settings

​

Identity Provider Settings

​

Mailbox Provider Settings

​

Service Account Password

​

2. Upload the Neo Script to Your RMM

• ConnectWise Asio
• Datto RMM
• ConnectWise Automate
• NinjaOne
• Kaseya VSA X

No upload required. ConnectWise Asio ships a built-in PowerShell script automation template that Neo uses to execute PowerShell on managed endpoints. Neo dispatches the wrapper code inline as the body parameter of that template on every run, so you don’t need to create or maintain any Neo-specific script in your Asio library.

Asio’s user-created PowerShell scripts (Add → PowerShell script in the Tasks page) don’t expose a “Parameters” tab, so Neo can’t use one as the wrapper. Don’t create a [Neo Script] Run Powershell task in Asio — it won’t be used.

1. Confirm an Asio agent is installed on the target server (DC, Exchange server, runner VM, etc.) and reporting osType=windows.
2. Trigger an RMM sync in Neo at Integrations → RMM so Neo discovers the endpoint and the built-in PowerShell script template.

1. Download the Neo PowerShell component:

Neo Script Run Powershell.cpt

Datto RMM component for executing Neo PowerShell scripts

2. Import the component into Datto RMM by following Datto’s import instructions.
3. Trigger an RMM sync in Neo by going to Integrations → RMM and clicking the sync button. This allows Neo to discover the newly imported script.

Build the wrapper in the Automate web Script Editor (Automation → Scripts).

1. Open Scripts → All Scripts and click + Add.

2. On the Summary tab, set Name to [Neo Script] Run Powershell, Target to Computer, and leave Function Script toggled off.

The name must match exactly, including the square brackets. Neo finds the wrapper by this name. Leave Function Script off, or the script can’t run against a computer.

3. On the Editor tab, click Parameters → Add and add a parameter named script_content_path.

4. Add an Execute Script step. Set Script Type to PowerShell, Script Credentials to Local Agent, Variable to @psoutput@, and paste this into the Script Editor:

$env:script_content_path = "@script_content_path@"
$neo_base_url = "https://engine.neoagent.io"
$script_content_path = $env:script_content_path
$script_content_url = "$neo_base_url/$script_content_path"

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$wc = New-Object System.Net.WebClient
$wc.Encoding = [System.Text.Encoding]::UTF8
$commands = ($wc.DownloadString($script_content_url))

$neo_output = ""
$neo_failed = $false
try {
    $neo_output = (iex $commands *>&1 | Out-String)
} catch {
    $neo_output = "ERROR: $($_.Exception.Message)"
    $neo_failed = $true
}

Write-Output $neo_output

try {
    $result_path = $script_content_path -replace '\?', '/result?'
    $result_url = "$neo_base_url/$result_path"
    $rc = New-Object System.Net.WebClient
    $rc.Encoding = [System.Text.Encoding]::UTF8
    $rc.Headers.Add("Content-Type", "text/plain; charset=utf-8")
    $null = $rc.UploadString($result_url, "POST", $neo_output)
} catch {
    Write-Output "NEO_RESULT_CALLBACK_FAILED: $($_.Exception.Message)"
}

if ($neo_failed) { exit 1 }

5. Add a Script Log Message step after it, with Message set to @psoutput@. This records the script’s output to the run history.

6. On the Settings tab, turn Enable Enhanced Script Logging on (required for the Log Message step to record output).
7. Save. The Editor should now show two steps — Execute Script, then Log Message:

8. Trigger an RMM sync in Neo at Integrations → RMM so Neo discovers the new script.

NinjaOne passes script parameters to the script as a single raw string instead of binding them to named variables (the way Datto and ConnectWise Automate do). The wrapper below reads the path Neo sends and runs it, so you do not need to configure any Script Variables or Parameters in NinjaOne. Neo supplies everything at runtime.

1. In NinjaOne, open the Automation Library and create a new script.
2. Name it exactly [Neo Script] Run Powershell.

The name must match exactly, including the square brackets. Neo finds the wrapper by this name.

3. Set Language to PowerShell, Operating System to Windows, and leave Run as set to System. Leave Script Variables and Parameters empty.
4. Paste this into the script body:

$ErrorActionPreference = "Stop"
$neo_base_url = "https://engine.neoagent.io"

# NinjaOne passes the script path to this wrapper as a raw "name=value" string,
# not bound to a named variable the way Datto and ConnectWise do. Pull the
# rmm/script path (with its ?code= token) out of whichever source carries it.
$path = $null
foreach ($candidate in @($env:script_content_path, ($args -join ' '))) {
    if ($candidate -and ($candidate -match '(rmm/script/\S+)')) { $path = $Matches[1]; break }
}
if (-not $path) {
    throw "Neo wrapper: no rmm/script path found. env='$($env:script_content_path)' args='$($args -join ' ')'"
}

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$wc = New-Object System.Net.WebClient
$wc.Encoding = [System.Text.Encoding]::UTF8
$commands = $wc.DownloadString("$neo_base_url/$path")

iex $commands

5. Click Save.
6. In Neo, go to Integrations → RMM and click the sync button so Neo can discover the new script.

When an agent runs an on-prem AD or Exchange action, Neo calls this wrapper, which downloads the generated PowerShell from Neo and runs it on the target machine.

1. In your VSA X portal, go to Automation → Scripts and create a new script.
2. Name it exactly [Neo Script] Run Powershell.

The name must match exactly, including the square brackets. Neo finds the wrapper by this name when it syncs your script catalog.

3. Set the script Type/Platform to PowerShell / Windows.
4. Add a single input variable named exactly script_content_path (type: text/string). Neo passes the script path into this variable at runtime.

VSA X keys script variables by an internal Id, but Neo resolves your script_content_path variable to its Id automatically at execution time — you only need to create the input variable with that name. (If the script defines exactly one input variable, Neo binds to it even if you named it differently, but matching script_content_path is the reliable choice.)

5. Paste this into the script body:

$ErrorActionPreference = "Stop"
$neo_base_url = "https://engine.neoagent.io"

# VSA X surfaces the script's input variable to PowerShell; the exact binding can
# vary by agent/runtime, so pull the rmm/script path (with its ?code= token) out of
# whichever source carries it — the bound variable, an environment variable, or args.
$path = $null
foreach ($candidate in @($script_content_path, $env:script_content_path, ($args -join ' '))) {
    if ($candidate -and ($candidate -match '(rmm/script/\S+)')) { $path = $Matches[1]; break }
}
if (-not $path) {
    throw "Neo wrapper: no rmm/script path found in the script_content_path variable."
}

# Download the generated script from Neo
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$wc = New-Object System.Net.WebClient
$wc.Encoding = [System.Text.Encoding]::UTF8
$commands = $wc.DownloadString("$neo_base_url/$path")

# Execute it
try {
    iex $commands
} catch {
    Write-Output "ERROR: $($_.Exception.Message)"
    exit 1
}

6. Save the script.
7. Trigger an RMM sync in Neo at Integrations → RMM so Neo discovers the new wrapper script.

Running scripts also requires the Automation permission group to be set to Read & Write in your VSA X agent’s settings — read-only Automation can browse the catalog but not execute. The Third-Party Token must likewise grant write access to Automation.

When an agent runs an on-prem AD or Exchange action, Neo calls this wrapper on the target device, which downloads the generated PowerShell from Neo and runs it.

​

3. Set Up a Runner Machine

​

3a. Install RSAT AD Tools

Install-WindowsFeature -Name RSAT-AD-PowerShell

Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

​

3b. Create a Dedicated Service Account

​

3c. Configure RMM Component Credentials

1. Go to Automation → Components and open the [Neo Script] Run Powershell component
2. Toggle Requires Component Credentials to ON
3. Click Save to apply the change

1. In Datto RMM, go to Setup → Credentials → Create Credential
2. Enter a Name (e.g., “Neo Agent Service Account”)
3. Set Scope to Site and select the client’s site
4. Set Type to Component
5. Enter the service account credentials:
   • Username: DOMAIN\neo_ad_automation
   • Password: (the service account password)
6. Click Create Credential

​

4. Enable Remote Execution

1. Enable PowerShell Remoting:
   Enable-PSRemoting -Force
   
   This configures WinRM and opens the necessary firewall rules. See Microsoft’s documentation for details and troubleshooting.
2. Grant the service account remoting access. The service account configured in Component Credentials must be able to establish remote PowerShell sessions to the target server. If the service account is not a Domain Admin, add it to the Remote Management Users group on the target server, or grant it WinRM access via Group Policy.
3. Verify network connectivity from the runner to the target server on port 5985 (HTTP) or 5986 (HTTPS).

​

5. Configure CredSSP for Exchange Runners

• Exchange Service Account Username — e.g., CONTOSO\SVC_NEO_AUTOMATION
• Service Account Password

Enable-WSManCredSSP -Role Client -DelegateComputer "EXCHANGE-SHORT","EXCHANGE-FQDN","*.yourdomain.com" -Force

Enable-WSManCredSSP -Role Server -Force

runas /user:DOMAIN\your_service_account powershell

$password = ConvertTo-SecureString 'YOUR_PASSWORD' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('DOMAIN\your_service_account', $password)
Invoke-Command -ComputerName "EXCHANGE-SERVER" -Authentication CredSSP -Credential $cred -ScriptBlock {
    Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn
    Get-ExchangeServer | Select-Object Name
}

• If it succeeds — CredSSP is configured correctly.
• If it fails with “A computer policy does not allow the delegation of the user credentials” — re-run Step 2 with the correct hostname forms, including the wildcard.
• If it fails with a permissions error — CredSSP is working, but the service account may lack Exchange permissions.

​

6. Verify Connectivity

​

Neo API connectivity

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri "https://engine.neoagent.io" -UseBasicParsing

​

AD tools (if using on-prem AD)

Import-Module ActiveDirectory
Get-ADUser -Filter * -ResultSetSize 1

​

Remote execution (if applicable)

# Test AD Connect server
Invoke-Command -ComputerName "AD-CONNECT-SERVER" -ScriptBlock { hostname }

# Test Exchange server
Invoke-Command -ComputerName "EXCHANGE-SERVER" -ScriptBlock { hostname }

• PowerShell Remoting is enabled on the target (Enable-PSRemoting -Force)
• The service account is in the Remote Management Users group on the target
• Port 5985 or 5986 is open between the runner and the target

​

Exchange Hybrid

• Standard mailbox operations (forwarding, delegation, shared mailbox conversion, permissions, etc.) route to Exchange Online via Microsoft Graph — the same as pure Exchange Online clients.
• On-prem Exchange cmdlets (e.g., Enable-RemoteMailbox for hybrid mailbox provisioning) are executed on the on-prem Exchange server when Neo’s agent determines they’re needed.

1. Set Mailbox Provider Type to “Exchange Hybrid” in Company Settings
2. Set the Exchange Server Hostname to the on-prem Exchange server
3. (Optional) Set the Exchange Runner Hostname if the Exchange server doesn’t have an RMM agent — then complete Step 3, Step 4, and Step 5

​

Troubleshooting

​

”The supplied credential is invalid” on Exchange Runner

Active Directory operation failed on . The supplied credential for 'DOMAIN\service_account' is invalid.

• CredSSP client not configured: Run Get-WSManCredSSP on the runner — it should show CredSSP is enabled as a client with the Exchange server in the delegate list.
• CredSSP server not configured: Run Get-WSManCredSSP on the Exchange server — it should show CredSSP is enabled as a server.
• GPO blocking delegation: If you see “A computer policy does not allow the delegation of the user credentials”, re-run Enable-WSManCredSSP -Role Client on the runner with the FQDN, short hostname, AND domain wildcard forms.
• Wrong password in Neo: Verify the service account password in the Companies tab is correct.

​

SSL/TLS Certificate Trust Error

The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri "https://engine.neoagent.io" -UseBasicParsing

• Expected result: 401 Unauthorized (confirms SSL/TLS is working)
• If you see an SSL error: The server’s certificate store needs updating

1. Update Windows root certificates — Install the latest Windows updates, or manually update certificates:
   certutil -generateSSTFromWU roots.sst
   certutil -addstore -f Root roots.sst
   
2. Check TLS 1.2 is enabled — Verify in registry:
   HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2
   
3. Check server clock — Certificate validation fails if the system time is significantly off
4. Check for proxy/firewall interference — Some security appliances intercept HTTPS traffic and can break certificate chains

​

No Internet Access / Firewall Blocking

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest -Uri "https://engine.neoagent.io" -UseBasicParsing

• Expected result: 401 Unauthorized (confirms connectivity is working)
• If you see a connection/timeout error: The server cannot reach the endpoint — check firewall rules and proxy settings

​

Other RMM Platforms

• N-Able N-Sight RMM
• N-Able N-Central
• ConnectWise RMM (Asio)