SHADOW01
Download Scripts / Download Scripts (JSON)
Export your entire NinjaOne script library as either PowerShell packages or raw JSON archives with SHA-validated payloads for compliance, cold storage, or tenant migrations.
Extension for Microsoft Edge and Google Chrome
Work smarter
in the shadows.
Back up, compare, report on and manage your NinjaOne scripts, policies, custom fields and more, directly from the interface you already use.
SHADOW / FOR NINJAONE41tools built into NinjaOne
3backup destinations: GitHub, Azure DevOps, Bitbucket
8reports you can export for stakeholders
v1.1.12latest release
See it in action
What SHADOW looks like inside NinjaOne.
SHADOW adds a menu and full-screen tools to the pages you already use. Every screen follows the same dark layout.
One menu, every tool
A floating SHADOW button opens a menu with every action available on the current NinjaOne page. Only the tools that fit the page you are on show up.
Full backups with live progress
Back up scripts, policies, custom fields and the technician permissions audit to GitHub, Azure DevOps or Bitbucket. Minimize the card to a small pill while it runs, or cancel at any time.
Compare scripts with your repository
Load the full library, filter by status, preview inline diffs and upload only what you select. Apply changes from the repository back into NinjaOne for GitHub and Azure DevOps.
Structural policy diffs
See exactly which policy fields differ from the version in your repository, path by path, and push the selected policies as a backup.
Find unused scripts
See where each script runs across policies, scheduled tasks and system tray, and spot scripts that are not referenced anywhere.
Reports for every stakeholder
Fleet Health, Asset, Activities, Automation Usage, Policy and Technician Permissions reports. Export to HTML, CSV, Markdown or PDF.
Custom fields at scale
Review and bulk-edit permissions, descriptions and tooltips, set organization values in bulk, and trace which scripts read or write each field.
Run a script once, without saving it
A short wizard picks the devices and runs a pasted PowerShell script. Nothing is stored in your script library.
NinjaRemote settings audit
Check effective remote-session settings per device against your own rules and see whether each value comes from the device, organization or tenant.
Bulk cloud monitors
Clone a monitor for a list of new IP addresses, or move several monitors to another organization in one request.
You decide who may use what
Sysadmins choose which SHADOW features technicians can use. Everything not on the allowlist stays sysadmin-only.
Previews marked "Sample data" are illustrations made with fictional organizations, devices and scripts. They show the layout of each tool, not real customer data.
Everything SHADOW adds
41 tools, grouped by what you are trying to do.
Short descriptions of every feature. The README has the full details.
Script & GitHub Automation 7
02
Import Scripts from JSON
Queue any number of SHADOW exports for re-import, preserve valid source category mappings when present, and only assign the SHADOW category when category data is missing, while skipping unsupported languages and respecting backup guardrails.
03
Compare with GitHub
Launch a full-screen diff overlay that progressively loads your entire library (no file-count cap), highlights status buckets, filters results, previews inline diffs, and queues uploads per detected language/extension.
04
Compare with Azure DevOps
The same full-screen diff overlay, filters, and per-script upload queue as Compare with GitHub — including applying selected changes back into NinjaOne — but against the Azure DevOps repository configured on the popup's Azure DevOps tab…
05
Import from GitHub
Browse the connected repository directly inside NinjaOne, multi-select PS1/SH/BAT/JS/VBS/CMD/JSON assets, choose a destination category (or preserve source categories), and import them in bulk with progress feedback and auto-refresh.
06
Script Usage
Open a single overlay that combines the former Used Scripts and Unused Scripts views, revealing where each script runs across policies, scheduled tasks, and system tray configurations…
07
Script Manager (Mass Script Management)
Open one overlay that lists every script (metadata only — no script body is decoded) for fast, library-wide organization, with two tabs.
Template Library Sync 3
01
Compare Templates
Analyse your environment against the official NinjaOne Template Library, review the remediation list, and optionally apply or skip updates with confirmation prompts.
02
Import from Public GitHub (ShadowGitSync)
Keep individual NinjaOne scripts aligned with a third-party GitHub source by storing a raw URL in the script's description (ShadowGitSync:<url>).
03
Import from Private GitHub
Browse your token-authenticated private repository from the Template Library page, multi-select scripts, choose a destination category (or preserve the source categories), and import them in bulk with progress feedback.
Ad-hoc Script Execution 1
01
Run Script Now (Device Search & Device pages)
Paste a raw PowerShell script and run it once on selected devices, without saving it to the script library first — no need to build a permanent script for a one-off task.
Custom Fields & Metadata 6
01
Device Custom Fields – Export / Import
Back up device-level metadata or restore field definitions from JSON exports, with per-file validation and backup enforcement.
02
Organization Custom Fields – Export / Import
Move customer-specific metadata between tenants and ensure the definitions stay consistent across environments.
03
Location Custom Fields – Export / Import
Keep branch/location data aligned by exporting and re-importing standardized definitions with a single click.
04
Custom Field Manager (Device / Organization / Location)
Open one filterable table of every custom field for the selected scope and review each field's Technician, Script, and API permission.
05
Custom Field Usage (Device / Organization / Location / System)
From the Reporting page, open Custom Field Usage to scan every NinjaOne script's code for custom-field reads and writes…
06
Bulk Set Values (Organization)
Set organization custom field values across all or selected organizations at once, two ways: (1) enter a value manually with a type-aware input for text, checkbox, numeric, date, single-select Dropdown, and Multi-select fields…
Policy, Backup & Compliance Operations 15
01
NinjaRemote Settings Audit (Device Search)
Open the NinjaRemote Settings Audit overlay from Device Search, pick organizations (searchable, defaults to all), then choose which NinjaOne Remote settings to audit…
02
Backup Now
Run a full backup from the System Dashboard that collects scripts, policies, and custom fields (each individually toggleable in the popup's GitHub tab), applies automatic path sanitisation, honours the “force local backup” setting…
03
Auto Backup Scheduling
When Auto backup is enabled, SHADOW checks backup age at extension startup and automatically runs a full backup once it exceeds the configurable max-age threshold, keeping backups fresh without manual effort or redundant runs.
04
Bulk Policy Assignment
Apply a monitoring policy to a selected device role across every organisation at once via an overlay that supports progressive loading, select-all toggles, and real-time success/error reporting.
05
Download Policies (JSON)
From the Administration ▸ Policies page (Agent/NMS/VM/MDM tabs), export every policy as a JSON ZIP grouped by device class — the same backup captured by Backup Now, available as a standalone, on-demand download.
06
Compare Policies with GitHub
From the Administration ▸ Policies page, open a structural (path-by-path, not text) diff between each live NinjaOne policy and its GitHub-backed-up copy, with a View Diff per changed policy showing exactly which fields differ…
07
Compare Policies with Azure DevOps
The same structural diff, per-field View Diff, filters, and progress bar as Compare Policies with GitHub, against the Azure DevOps repository instead.
08
Policy Report
Generate structured policy documentation from the Reporting page with selectable sections, PDF-friendly output, and optional raw JSON companion exports.
09
Policy Override Audit
Launch the Overrides audit from the Reporting page to identify inherited vs overridden values across a policy tree and its devices.
10
Asset Report
Open a dedicated asset lifecycle view from the Reporting page that analyzes managed workstation/server inventory by warranty-age buckets, surfaces insights (e.g., old/unknown devices), and provides exportable report output…
11
Fleet Health Report
A tenant-wide and per-organization health scorecard from the Reporting page, built from the same aggregate data behind NinjaOne's own System Dashboard: device health, patch and vulnerability status, backup failures, triggered alerts…
12
Automation Usage Report
From the Reporting page, see which automations (policy-condition-triggered actions and manually/scheduled-run scripts) ran over a date range, how many times each ran, and success vs. failure counts…
13
Technician Permissions Report
From the Reporting page, audit every technician role's full permission set as a searchable role × permission matrix, save a snapshot to GitHub…
14
Activities Report
From the Reporting page, pull the tenant activity log for a minute-precision date/time range and filter by activity type…
15
Backup Security Overlay
Track when backups were completed, view the daily status, and require a same-day backup before any script or field import can proceed.
IT Asset Management (ITAM) Templates 3
01
Add Unmanaged Devices
Open an overlay with curated ITAM parent/child templates grouped by technology stack, preview icon matches from your existing tenant, and queue role creation with automatic batching, countdown pauses, and resume prompts that avoid MFA lockouts.
02
Import Unmanaged Devices
Load JSON template files generated by SHADOW to reproduce complex ITAM role structures in new tenants while reusing stored custom fields and hierarchy metadata.
03
Export Unmanaged Devices
Capture your current unmanaged-role definitions as JSON for audit trails, change reviews, or peer sharing.
Cloud Monitor Tools 2
01
Clone with new IP(s)
Pick a template — either an existing Cloud Monitor (its type, frequency, timeout, and alert conditions are cloned as-is) or Build new…
02
Move to organization
Select one or more existing Cloud Monitors and move them to a different organization/location in a single bulk request.
Role-Based Access Control (RBAC) 4
01
SHADOW-Admin: RBAC Settings
A button visible only to sysadmin technicians, on Administration ▸ Users ▸ Security Settings.
02
How it's stored
Your choices are saved as a JSON payload in the value of a single, auto-created, tenant-wide GLOBAL-scope custom field (one value for the whole tenant, not per-device/org/location).
03
Enforcement
Every gated SHADOW button/overlay checks the current technician's NinjaOne sysadmin flag live before rendering; features not on the allowlist are hidden entirely for non-sysadmins (not just disabled)…
04
Fail-safe design
If the configuration was never saved, or can't be read at all (network error), features fail open (nothing restricted) so the extension never silently breaks for the whole team before it's configured.
Version control
Bring your own repository.
Connect GitHub, Azure DevOps or Bitbucket Cloud. Each backup goes to exactly one destination, chosen in the popup.
GITHUB
Backup, compare and import
✓ Backup ✓ Compare ✓ Apply back to NinjaOne ✓ Private import
AZURE DEVOPS
Backup and compare
✓ Backup ✓ Compare ✓ Apply back to NinjaOne
BITBUCKET CLOUD
Backup
✓ Backup – Compare not available yet
Where to find it
The buttons SHADOW adds, page by page.
Every tool shows up on the NinjaOne page where it makes sense.
| NinjaOne area | Added by SHADOW |
|---|---|
| System Dashboard ▸ Overview | Backup Now |
| Administration ▸ Library ▸ Template Library (Scripting & Automation) | Compare Templates, Import from Public GitHub, Import from Private GitHub |
| Administration ▸ Library ▸ Automation | Download Scripts, Download Scripts (JSON), Import Scripts from JSON, Compare with GitHub, Compare with Azure DevOps, Script Usage, Script Manager |
| Administration ▸ Devices ▸ Device Custom Fields | Export, Import, Custom Field Manager |
| Administration ▸ Customers ▸ Organization Custom Fields | Export, Import, Custom Field Manager, Bulk Set Values |
| Administration ▸ Customers ▸ Location Custom Fields | Export, Import, Custom Field Manager |
| Administration ▸ Customers ▸ Organizations | Bulk Policy Assignment, Cloud Monitor Tools |
| Administration ▸ Policies (Agent/NMS/VM/MDM tabs) | Download Policies (JSON), Compare Policies with GitHub, Compare Policies with Azure DevOps |
| Administration ▸ Users ▸ Security Settings | SHADOW-Admin: RBAC Settings (sysadmin only) |
| Reporting | SHADOW Policy Report, Overrides, Asset Report, Fleet Health, Automation Usage, Custom Field Usage, Technician Permissions, Activities |
| Device Search | NinjaRemote Settings Audit, Run Script Now |
| Device Dashboard (individual device page) | Run Script Now |
| Administration ▸ Devices ▸ Roles (Unmanaged) | Add Unmanaged Devices, Import Unmanaged Devices, Export Unmanaged Devices |
What's new
Recent releases.
The latest three versions at a glance.
Version 1.1.122026-09-23
- ChangedSHADOW-Admin: RBAC Settings moved to Security Settings.
- NewNinjaRemote Settings Audit (was NinjaRemote Confirmation Audit).
- Newhover explanations across the reports.
- NewMarkdown export on every report.
- ChangedActivities Report and Automation Usage Report no longer run on open.
- NewCustom Field Usage moved to Reporting, now with System custom fields and Markdown export.
- NewDevice dashboard links in Activities Report and Automation Usage Report.
- Fixeddate/time pickers were unreadable in dark mode, across every report and overlay.
- Securityhardened large runtime-message transfers.
- Securitybounded remote GitHub downloads.
- Securityreduced credential exposure.
- Securityrepository target pinned to your saved settings.
- Securityerror messages escaped in overlays.
- FixedGitHub, Azure DevOps and Bitbucket features on the NinjaOne US Federal instance.
Version 1.1.112026-08-15
- NewTechnician Permissions Report.
- NewTechnician permissions audit included in the full backup.
- NewPrint PDF for Policy Override Audit and Technician Permissions Report.
- FixedGitHub "does this file already exist" checks could silently fail.
- Fixeda page-specific SHADOW button could stay visible on the wrong page.
- NewPolicy Override Audit no longer scans device-level overrides by default.
- Newmore detail on patch scan/update/reboot settings in Policy Report.
- FixedAntivirus reboot behavior always showed "—" in Policy Report regardless of the real setting.
- NewActivities Report.
- NewFleet Health Report.
- NewFleet Health Report gets its own visibility checkbox on the Options tab (previously only reachable through the shared "Reporting buttons" checkbox).
- NewAutomation Usage Report.
- NewAutomation Usage Report gets a By Organization breakdown (sortable by run count, name, or failures) and an Executive Summary view — a condensed, client-ready snapshot with headline numbers, top automations, and a per-organization rollup.
- Fixedsaved/printed HTML for Activities Report, Fleet Health Report, and Automation Usage Report showed black, hard-to-read text instead of the intended light theme.
- NewAutomation Usage Report gets a Devices filter, the same searchable multiselect Activities Report already has, to narrow the query itself to specific devices.
- NewAutomation Usage Report's Devices filter is joined by an Organizations filter, both now living in the report's own picker bar with the exact same layout and searchable-checkbox-list style as Activities Report's Organizations/Devices filters (Devices narrows to whichever organizations are selected, same as Activities Report).
- NewAsset Report and Fleet Health Report get the same searchable Organizations/Devices multiselect filters as Activities Report and Automation Usage Report.
- NewActivities Report's activity type filter is now a searchable multiselect instead of a single-choice dropdown, so you can filter to several types at once (e.g.
- Newa Credits section on the popup's Help tab.
- NewBitbucket Cloud as a third, independent backup destination.
- NewNinjaOne US Federal instance support.
- Fixedlarge backups could silently fail and fall back to a local ZIP.
Version 1.1.102026-07-31
- FixedCompare with GitHub's side-by-side diff had its colors backwards.
- NewPolicy Backup to GitHub.
- NewCompare Policies with GitHub.
- Newchoose what Backup Now includes.
- NewAzure DevOps as a second, independent sync target alongside GitHub.
- NewBackup destination toggle (GitHub vs Azure DevOps).
- Newminimize the Backup Now progress card.
- Changedthe popup's Options tab is now first, and is the only place Debug logging and the Backup destination (GitHub / Azure DevOps) toggle live — both used to sit on the GitHub tab and Debug logging previously showed underneath every tab regardless of which one was open.
- Changedpopup tab names and order.
- ChangedSHADOW-Admin: RBAC Settings now groups its feature list by page (Scripts page, Template Library, Custom Fields, Reporting, Other) instead of one long flat list — the same grouping the popup's Options tab already uses for button visibility, so the two allowlists read the same way.
- Changedmoved Backup Now includes (Scripts/Custom fields/Policies), Force local backup, Auto backup, Auto backup max age, and Script editor on right from the GitHub tab to the Options tab.
- NewHelp tab.
- Fixedtwo of the Options tab's controls didn't actually save when changed.
- Fixedseveral button tooltips referenced the old "Backup Repo" / "Private Repo" tab names (now GitHub / Private GitHub).
Get started
Up and running in four steps.
Install in Edge or Chrome
Add SHADOW from the Microsoft Edge Add-ons store or the Chrome Web Store and open NinjaOne.
Connect a repository
Create a token for GitHub, Azure DevOps or Bitbucket and enter it in the SHADOW popup. Use Test Connection to check it.
Pick your options
Choose the backup destination, what a backup includes and which buttons are visible.
Use the SHADOW menu
Open the SHADOW button in NinjaOne and run backups, comparisons, reports and bulk actions.
Security first
Your credentials stay in the background.
SHADOW talks to NinjaOne's own web endpoints and to the repository you choose. Nothing is sent anywhere else.
Read the privacy policy ↗- Encrypted tokensTokens are AES-GCM encrypted and only decrypted inside the extension's background service worker.
- Role-based accessSysadmins decide which features technicians can use, and sensitive tools re-check this inside the feature itself.
- Validated and rate limitedRepository names and paths are sanitized and every write goes through a rate-limited wrapper.
- Escaped outputNames from NinjaOne and GitHub are escaped before they appear in reports and pickers.
Brand
One mark, one color.
The S with a katana slash on near-black, in SHADOW orange. The same logo, palette and black-and-orange buttons are used in the extension and on this site.
Black#090909
Panel#12100e
Line#3d2b1e
Ink#fff2e6
Muted#a8907b
SHADOW orange#ffb86b
Keep the rounded corners, do not recolor the mark and leave clear space around it. SHADOW is independent and not affiliated with NinjaOne, Inc.
Get SHADOW
Bring SHADOW into NinjaOne.
Install the extension from Microsoft Edge Add-ons or the Chrome Web Store, inspect the project on GitHub, or ask a question on Discord.
Independent project. Not affiliated with, endorsed by or sponsored by NinjaOne, Inc. SHADOW uses NinjaOne's internal web endpoints, which can change without notice.
SHADOW began as a PowerShell script by David Spzunar.