Enterprise Workspace
The Enterprise Workspace runs chosen Windows applications, the work apps, inside an isolated enclave on the user's device. Their data can live on an encrypted disk, and the restrictions you set keep it from leaving: clipboard, printing, screen capture, keylogging, a watermark, desktop recording and integrity protection. A workspace can also get its own network identity, so work apps reach only what the workspace's policies allow.
You configure the workspace as a component of a profile, under Endpoint > Profiles. For the profile itself, see Profiles.
The Enterprise Workspace exists only on Windows x64 devices with the full (administrator) install of the Netzilo client. A Windows ARM64 device, a non-administrator install, macOS and Linux get no workspace, whatever the profile says. Saving a profile needs the Enterprise plan.
How it works
- A profile with an Enterprise Workspace reaches a Windows x64 device in one of its groups.
- The Netzilo client service creates the workspace and places shortcuts for the work apps on the user's Desktop and under Start Menu > Programs > Netzilo.
- A work app started from those shortcuts runs inside the enclave with the profile's restrictions. A supervising process watches the work apps; if it stops, they close.
- With an Encryption Key, the workspace's files live on an encrypted disk image,
C:\Netzilo\<name>.box. Its size is fixed when it is created: the smaller of 4 GB and half the free space on the system drive. With Use Workspace Filesystem, they live in an encrypted folder in the user's profile instead. Without a key, the work apps are isolated without a separate disk. - With a Setup Key for Netzilo Network, the workspace runs its own Netzilo instance
and joins as a separate peer,
<host>-WORKSPACE. All work-app traffic leaves through that peer and reaches only what its groups and policies allow. Without a key, work apps use the device's own network and tunnel.
Profiles do not distribute software. A work app must already be installed on the device at the path you enter.
Add the workspace to a profile
Open a profile under Endpoint > Profiles, or click Add Profile, and click the Enterprise Workspace card. The dialog has three tabs: Work Apps, Restrictions and Posture Checks. Click Save Changes in the dialog, then save the profile.
Work Apps
Click Add Application and enter the application's path, for example
c:\windows\system32\notepad.exe. Wildcards and regular expressions are accepted, and the
field suggests common applications as you type.
Click ⋯ on a row to open Application Settings:
| Field | What to enter |
|---|---|
| Path | The application's executable. |
| Command line arguments | Arguments passed to the application, for example /c /f. Optional. |
| Friendly name | The name shown on the shortcut, for example Google Chrome. Optional. |
| Add Hash | File hashes the executable must match. Optional. |
| Add Signer | Code signers the executable must be signed by. Optional. |
When hashes or signers are set, an executable that does not match them does not start in the workspace, for example after the application updated itself.
Restrictions
Click a card to configure it. Its pill turns ON once it is set; click ON to turn it off again.
| Setting | What it does |
|---|---|
| Enforce Isolation | Creates the isolated enclave for the work apps. Opens the isolation settings described below. |
| Add Watermark | Draws a text watermark over the work apps, Dense or Sparse. These placeholders are replaced on the device: %netzilo.username%, %netzilo.hostname%, %netzilo.ip%, %netzilo.region% and %netzilo.deviceid%, for example %netzilo.username% - CONFIDENTIAL. Other text, including bracketed placeholders such as [USERNAME], is printed as written. |
| Restrict Clipboard Access | Block copy/paste from workspace: users cannot copy out of work apps. Block copy/paste to workspace: users cannot paste into them. Block copy/paste to and from workspace: both. |
| Restrict Printing | Work apps cannot print. |
| Restrict Screen Sharing | Screen capture and screen-sharing applications cannot capture the work apps. Turning it on turns Record Desktop Activity off. |
| Record Desktop Activity | Records the desktop as video while the user works in work apps. Needs an Amazon S3 or Min.io integration under Integrations > Event Streaming, and a privacy policy link the user accepts before the first work app opens. Turning it on turns Restrict Screen Sharing off. |
| Restrict Key-logging | Protects keystrokes typed into work-app windows from keylogging applications. |
| Verify Workspace Integrity | Hardens the work apps against attacks such as rooting, debugging and memory injection. Detections are recorded as events. |
| Create Desktop Shortcut for Work Apps | The folder name for the work-app shortcuts, for example Work Apps. The folder is created on the Desktop and under Start Menu > Programs > Netzilo. Without a name, no shortcuts are created. |
| Show Border | Draws a coloured border around work apps so users can tell them apart. Choose a colour, a custom colour, or None. |
Every profile update deletes and recreates the shortcut folder on the Desktop. Choose a name no one would use for their own files, and tell users it is not a documents folder.
Record Desktop Activity asks for a privacy policy link in a Show Privacy Policy dialog. The user must accept it before the first work app opens.
If the recorder cannot start, because the user declined or the storage integration is
missing, the work app does not open and the workspace closes. Recordings appear under
Activity > Events as session.recorded once the first part has uploaded, and in the
User Activity report.
Isolation settings
Click Enforce Isolation to open its Settings.
| Setting | What it does |
|---|---|
| Encryption Key | Optional. Encrypts the workspace's disk. Generate a key with the refresh button and copy it with the copy button. Changing the key of an existing workspace resets it and wipes its data; the dashboard asks you to confirm. |
| Use Workspace Filesystem | Optional. Stores the workspace's data in an encrypted folder instead of a disk image, which is more compatible and faster. Under Allowed Apps, list host applications that may open files in it, for example %ProgramFiles%\Microsoft Office\*\WINWORD.EXE. |
| Setup Key for Netzilo Network | Optional. A setup key with which the workspace joins as its own peer, <host>-WORKSPACE. Use a reusable key; see Setup Keys. |
| Use Workspace VPN | VPN adapters that only the workspace uses, such as eth0, and the applications they allow. |
| Create Document Shortcuts | Creates shortcuts outside the enclave for documents downloaded inside it, such as .pdf and .ppt files. |
| Wipe Data When Closed | Deletes everything created inside the enclave, such as downloaded files, when all work apps are closed. |
| Trusted Certificates | X.509 certificates the work apps trust. Upload a certificate file and, if needed, its key file. |
Click Save in this dialog.
Posture Checks
Click Browse Checks to attach existing posture checks, or New Posture Check to create one. Under Posture Check Evaluation, choose whether All checks must pass or Any one.
The workspace re-checks them about every 15 seconds. While a check fails, the work-app
windows are blurred and a workspace.posture.check event is recorded. The workspace keeps
running, and the blur clears by itself once the check passes. See
Posture Checks.
The workspace's own peer
With a Setup Key for Netzilo Network, the workspace appears under Endpoint > Peers
as <host>-WORKSPACE. It has no owner, joins the key's auto-assigned groups, and is
reachable only under the policies of those groups. Give it a policy to the resources the
work apps need.
The Enterprise Workspace posture item is true only on that peer, never on the ordinary Windows host. Putting it on a network policy for ordinary devices blocks all of them. Attach it only to policies whose sources are workspace peers.
What users see
- A folder with the work-app shortcuts on the Desktop and under Start Menu > Programs > Netzilo.
- Work apps with the border colour and watermark you chose.
- A privacy policy to accept before the first work app opens, when recording is on.
- Blurred work-app windows while a posture check fails.
- Your workspace will be restarted in N seconds. when an administrator saves a change to the workspace. Ask users to save their work before you save. Changing the encryption key also wipes the workspace's data.
- Pasting into or copying out of work apps fails in the direction you blocked.
Events
The workspace records workspace.app.started, workspace.posture.check,
workspace.print.blocked, workspace.injection.detected,
workspace.selfdefense.activated and session.recorded under Activity > Events. See
Event reference.
Troubleshooting
Work apps have no network; the "Initializing Netzilo ..." splash never clears. The
workspace's setup key is one-off, expired, revoked or used up, so the -WORKSPACE peer
never joined. Or it joined, but its groups have no policy to the destination. Replace the
key with a reusable one, or give the peer's groups a policy. Saving the profile restarts
the workspace.
Every ordinary device lost access right after a policy change. An Enterprise Workspace or Enterprise Browser posture item was added to a policy for ordinary devices. Those items are true only on the workspace's or browser's own peer. Move the check to a policy whose sources are those peers.
No shortcuts on the Desktop or in the Start Menu. The folder name under Create Desktop Shortcut for Work Apps is empty, or the application is not at its configured path. If the client service started before the user signed in, the shortcuts appear after the next sign-in or service restart.
The workspace is never created. Check that the device is Windows x64 with the full install, that it is in the profile's groups and that the profile is Active. An encrypted workspace also needs the virtual-disk driver that the full install provides.
"Browse in Netzilo Workspace" does nothing, or the site is just blocked. The device has no workspace: it is not Windows x64 with the full install, or the workspace failed to be created. Elsewhere, blocking is the only outcome.
A work app opens and closes at once, with recording on. The user declined the privacy
policy, or the S3 or Min.io integration is missing or wrong. A session.recorded event
proves the recording works.
"Disk full" inside the workspace. The encrypted disk's size was fixed when it was created. Ask users to move files out. A bigger disk needs a reset of the workspace, which destroys its data, or switching the profile to Use Workspace Filesystem.
Work-app windows are blurred. A workspace posture check fails. The
workspace.posture.check event names it. Fix the device setting; the blur clears by
itself.
Files the user saved in the shortcut folder disappeared. Every profile update recreates that folder. Rename it to something nobody would store files in.
Work apps crash, or the workspace filesystem does not mount. Endpoint security
software treats the workspace engine as suspicious. Exclude %ProgramData%\Netzilo Client
and C:\Netzilo in that product.
Related Documentation
- Profiles - Groups, operating systems and components
- Setup Keys - The key for the workspace's own peer
- Posture Checks - Requirements that blur the work apps when they fail
- Event Streaming - The S3 or Min.io storage for recordings
- Browser Extension - Send web domains into the workspace
- Enterprise Workspace concepts - Why and when to use a workspace