Skip to main content
Sign in More Resources

Download the latest Client Filter and build a custom MSI/MST with Orca

Bradley Dumpleton
  • Updated

 

 

Overview

The Client Filter ships as a standard Windows MSI. On its own, it does not know which Policy Server to talk to or which Brand to use.

You add that with one MSI property, CONFIGEDIT. It holds your Client Filter settings: Policy Server, Brand and filter flags.

Orca lets you write that property into a transform file (.mst). Install the MSI with the MST and the device is configured on first launch. No manual setup on each machine.

The process has five parts:

  1. Download the latest Client Filter MSI.
  2. Get your configuration (CONFIGEDIT string) from the registry of a working device.
  3. Install Orca.
  4. Create the MST in Orca.
  5. Deploy and verify.

Part 1: Download the latest Client Filter

  1. Go to the Netsweeper Support Portal at support.netsweeper.com and sign in.
  2. Open News, Updates, & Releases, then Client Filter Release Notes.
  3. Open the newest article titled “<version> GA Client Filter Release and Downloads”. Use a GA (General Availability) release for production. EA (Early Access) releases are for testing.
  4. Under Downloads › Windows, click Windows Client Filter (64bit MSI) <version>.
  5. Save the file to a working folder, for example C:\Deploy\ClientFilter. Keep the original file name so you always know which version you are packaging.

 

Figure 1. The Windows MSI link in a Client Filter Release and Downloads article.

Latest at time of writing:  Client Filter 13.80 GA (released 23 September 2026). The file is Netsweeper Client Filter - 13.80.55.55 win64.msi. Always check the Release Notes section for anything newer before you build.

 

Part 2: Get your Client Filter configuration

The MSI needs a CONFIGEDIT string. At minimum it contains your Policy Server (-p). The easiest way to get it is to copy it from a device that is already filtering correctly. Your new package will then match that device exactly.

In Client Filter 13, this string is shown in the Pushed Config setting.

  1. On the working device, open the Netsweeper Client Filter app.
  2. Select Filter in the left-hand menu, then open the Settings tab.
  3. Scroll to Pushed Config, or type Pushed Config in the Search box to jump to it.
  4. Click in the Pushed Config field and press Ctrl + A, then Ctrl + C. The field is wider than the box on screen, so select it this way to be sure you copy the whole string.
  5. Paste it into Notepad and save it as configedit.txt. You will paste it into Orca in Part 4.

Figure 2. Client Filter 13 › Filter › Settings. The Pushed Config field holds your CONFIGEDIT string.

Example: -p filter.ukcloud8.netsweeper.com:3431 -i nsw_ …

Field empty?  If Pushed Config is blank, contact Netsweeper Support for your Policy Server address and Brand name. Then write the string yourself in this format: -p <policy-server>:<port> -y <BrandName>.

 

Check before you copy:  Confirm the device is filtering correctly before you take its settings. Whatever is in Pushed Config is what every new install will get.

 

Common ConfigEdit options

You will usually see these options in the string:

Option Setting What it does
-p Policy Server Policy Server address, as server:port, ssl://server:port or scheme://server:port. The default port is 3432.
-y Company/Brand Brand name. Case sensitive. It must match your Brand exactly.
-f Flags Filter behaviour, as a single number. Add the flag values together, for example 2048 = Enable HTTPS Filtering, 1 = Fail Closed.
-g Group Override Forces a specific filtering group name.
-n User Override Forces one user name for every user on the device.
-u Uninstall Password Uninstall password. It must be the base64-encoded binary MD5 sum of the password.

 

For every option and flag value, see ConfigEdit Settings in the Netsweeper documentation.

Part 3: Install Orca

Orca is Microsoft’s free MSI table editor. It ships with the Windows SDK.

  1. Download the Windows SDK installer from Microsoft (search for “Windows SDK download”).
  2. Run it. On the feature list, select only MSI Tools and finish the install.
  3. Browse to C:\Program Files (x86)\Windows Kits\10\bin\<version>\x86\.
  4. Run Orca-x86_en-us.msi to install Orca.

Once installed, right-clicking any MSI shows Edit with Orca.

Part 4: Create the MST with Orca

Why a transform?  An MST leaves the Netsweeper MSI untouched. When a new Client Filter version comes out, you download the new MSI and rebuild a small MST, rather than editing and re-signing installers.

 

  1. Right-click the Client Filter MSI and choose Edit with Orca.
  2. Open the Transform menu and choose New Transform. The title bar now shows “(transformed)”. Every change from here is recorded in the transform.

 

Figure 3. Orca › Transform › New Transform.

  1. In the Tables list on the left, click Property.
  2. Find CONFIGEDIT and double-click its Value cell.
  3. Paste the string you saved in Part 2, then press Enter. The changed row is highlighted in green.

 

Figure 4. CONFIGEDIT in the Property table, with the configuration string pasted in.

  1. Open the Transform menu and choose Generate Transform.
  2. Save the file next to the MSI with a clear name, for example MyOrg-ClientFilter.mst.
  3. Close Orca. When asked, do not save changes to the MSI itself.

 

Figure 5. Orca › Transform › Generate Transform saves your MST.

Alternative: You can save the changes straight into a copy of the MSI with File › Save As. That gives one self-contained file, but you must redo the edit for every new release. The MST approach is easier to maintain.

Before you use Save As: In Orca, open Tools › Options, select the Database tab, and tick Copy embedded streams during 'Save As'. Then click OK. Without this setting, the saved copy can leave out the MSI's embedded files (for example, the CAB that holds the installer files), and the new MSI will fail to install.

 

Figure 6. Orca › Tools › Options › Database, with “Copy embedded streams during 'Save As'” ticked.Figure 5. Orca › Transform › Generate Transform saves your MST.

Alternative:  You can save the changes straight into a copy of the MSI with File › Save As. That gives one self-contained file, but you must redo the edit for every new release. The MST approach is easier to maintain.

 

Part 5: Test on one machine

Before you roll the package out, install it on a single test machine and confirm it connects and filters.

Install the package

Copy the MSI and your MST to the test machine. Open Command Prompt as Administrator, change to that folder and run:

msiexec /i "Netsweeper Client Filter - 13.80.55.55 win64.msi" TRANSFORMS="MyOrg-ClientFilter.mst"

Follow the installer through to the end, then restart the machine if prompted.

Confirm it is connecting

  1. Open the Netsweeper Client Filter app and select Filter in the left-hand menu.
  2. Open the Diagnostics tab and run the check.
  3. Confirm the Client Filter reports a successful connection to your Policy Server.
  4. On the Settings tab, check that Pushed Config matches the string you put in the MST.

 

Figure 6. The Diagnostics tab confirms the Client Filter can reach the Policy Server.

Confirm it is filtering

  1. Open a web browser on the test machine.
  2. Browse to a site in a category your policy blocks. You should see the Netsweeper deny page instead of the site.
  3. Browse to a site your policy allows, for example your organisation’s homepage. It should load normally.
  4. Try both an http:// and an https:// site, so you know secure sites are filtered too.
  5. Optional: open the Requests tab in the Client Filter app to see each site you visited and whether it was allowed or blocked.

 

Figure 7. The Netsweeper deny page confirms filtering is working.

All good?  Once the test machine connects and filters as expected, deploy the same MSI and MST to the rest of your devices with your usual software deployment tool.

 

Troubleshooting

Symptom What to check
Client installs but shows no Policy Server or Brand The MST was not applied. Check the TRANSFORMS= path, and that you saved the MST with Generate Transform, not only in Orca.
Users land in the default group The string may have been cut short when copied. Compare it with Pushed Config on your working device character by character.
Diagnostics cannot reach the Policy Server Check the address and port in -p, and that the device can reach it through any firewall or proxy.
Pushed Config is blank on the working device Contact Netsweeper Support for your Policy Server and Brand name, then write the string yourself (see Part 2).
Blocked sites still load Check the Diagnostics tab shows a connection, and that the test machine is in the group or policy you expect. Clear the browser cache and try again.
Install fails Re-run the msiexec command with /l*v "%TEMP%\NSCF-install.log" added. Search the log for “Return value 3” to find the failing step.

 

If you have any question or need further support please raise a ticket through the Netsweeper Support Portal and attach the install log and your MST.