N-able N-central Setup Beta

Connect N-able N-central to let Junto look up a customer's devices, read hardware, software, network, OS, and warranty inventory, see which monitors are failing and which issues N-central is raising, and read script output. With approval, the agent can also run catalogued scripts, restart Windows services, leave device notes, set custom properties, create remote-control tasks, and decommission retired devices.

Junto supports one N-central configuration per organization. Connect your N-central server once, then map N-central customers to Junto companies so the agent can retrieve each customer's devices.

N-central tools are available in Explore chat and through your connected MCP client. They are not available to runbooks.

Prerequisites

• A Junto Admin or Owner account
• An N-central server running 2023.9 or later, reachable over HTTPS
• An N-central API-only user with access to the customers you want to connect, and with two-factor authentication turned off
• The JSON Web Token generated for that user (Step 1)
• Customer companies in Junto, imported from your PSA, to map to N-central customers

Step 1: Create an API-Only User and Generate a JSON Web Token

1. Sign in to N-central as an administrator.
2. Go to Administration > User Management > Users and create a dedicated user for Junto. Mark it as an API-only user, and give it access to every customer the agent should be able to work with.
3. Confirm two-factor authentication is off for this user. N-central cannot exchange the token while two-factor authentication is enabled.
4. Open the user, go to API Access, and click Generate JSON Web Token.
5. Copy the token and store it securely. Regenerating the token later revokes the previous one, so you will need to update Junto if you do.

Keep the API user's account in good standing. If N-central disables or locks the user, or the user's password expires or requires a reset, Junto can no longer connect even though the token itself is still present.

Step 2: Configure in Junto

1. Go to Settings > Integrations > N-central.

2. Click Add configuration.

3. Complete the form:

   Field	What to enter
   Server URL	Your N-central server's address with no path, such as https://your-server.n-able.com
   User-API token	The JSON Web Token from Step 1

4. Click Create.

Junto tests the connection before saving: it exchanges the token, reads the server version, checks the API user's status, and counts the customers it can see. If the test fails, the configuration is not saved and the error explains why. Junto encrypts the token when stored.

After the save, the N-central configuration card shows the server address, an Active badge, the Server version, the Last health check time, and a Health badge. If the health check found a problem with the API user (for example, two-factor authentication enabled or an expired password), the message appears on the card. Click Test connection at any time to run the check again; the button shows Connected or Failed with the result.

Step 3: Map Companies

1. Click Company mapping on the configuration card to open N-central company mapping.
2. For each Junto company, select its N-central customer. Customers are listed by name, followed by their N-central External ID when one is set.
3. Click Save mappings.

You can also click Run auto-map. Junto first matches customers to Junto companies by PSA company ID when your N-central server has its own PSA integration, or when the customer's External ID holds the PSA company ID. It then falls back to exact name matches, which are applied automatically, and presents similar names as suggestions for you to review and confirm. Save any manual selections before running auto-map.

Each Junto company maps to one N-central customer, and a customer that is already mapped is marked already mapped in other companies' lists. The Status column shows Mapped or Unmapped for each company. To remove a mapping, return the selection to Select N-central customer... and save. An unmapped company cannot use the N-central tools; the agent reports this and names the settings page.

Sites stay under their customer. The agent can list a customer's sites and filter devices or issues by site without any extra mapping.

Step 4: Build the Script Catalog

N-central does not expose a list of its script repository, and it only runs repository items that have Enable API turned on. The Script catalog card on the N-central settings page is where you record the scripts and automation policies the agent may run. The agent can only run items in this catalog.

1. In N-central, open Configuration > Scheduled Tasks > Script/Software Repository and find the script you want the agent to use. Confirm Enable API is on. Bundled N-central scripts cannot be API-enabled; clone one first and enable the clone. Note the item's Repository ID.

2. In Junto, click Add script on the Script catalog card.

3. Complete the Add script dialog:

   Field	What to enter
   Repository id	The N-central repository ID of the script, automation policy, or Mac script
   Type	Script, AutomationPolicy, or MacScript
   Name	A name the agent and technicians will recognize
   Description	What the script does and when the agent should use it
   Parameters	One entry per input the script declares in N-central: its internal name (not the label), type, optional default value, and whether it is Required

4. Click Add.

The repository ID and parameter names must match N-central exactly. A script with a password-type parameter can be catalogued, but the agent will not run it, because the secret would have to pass through the approval record; run those scripts from N-central or catalog a variant that reads the secret on the device.

Each catalog row shows the script's Name, Repository id, Type, Parameters, and an Enabled or Disabled badge. Click the edit icon to change a script's details or turn Enabled for the agent off without removing it. Click the remove icon, then Remove, to drop it from the catalog; the script itself stays in N-central.

What the Agent Can Do

Capability	What Junto can do	Risk level
Sites	List the sites under a mapped customer to filter devices and issues by location	Low
Device lookup	Browse a customer's devices or find one by name or IP; filter by device class, site, online state, or a saved N-central device filter; see last check-in, last logged-in user, OS, and remote-control availability	Low
Hardware inventory	Read manufacturer, model, serial number, memory, processor, BIOS, drives, volumes, and video controllers	Low
Software inventory	List applications installed on a device, or find which of a customer's devices have a given application or version	Low
Windows services	List the services configured on a device with their startup type, account, and executable	Low
Network inventory	Read adapters, IP and MAC addresses, DNS and DHCP servers, discovered open ports, and shared folders	Low
OS detail	Read OS version and build, install date, last boot time, license type, PowerShell version, and printers	Low
Logged-in user	See who last signed in to a device and whether they are still signed in	Low
Warranty and lifecycle	Read warranty expiry, lease expiry, purchase date, expected replacement date, cost, location, and asset tag	Low
Monitor status	See the state of every monitoring service on a device (Agent Status, CPU, Memory, Disk, Patch Status, Firewall, and others), optionally only the ones with problems	Low
Active issues	List what N-central is raising for a customer or site, including the device, failing service, acknowledgement, and any linked PSA ticket	Low
Tasks and script output	List a device's scheduled and direct-support tasks and read a task's status and per-device output	Low
Device notes and custom properties	Read the notes technicians left on a device and the custom properties set on it	Low
Script catalog	List the catalogued scripts and automation policies, with their parameters	Low
Add device note	Leave a plain-text note on a device, prefixed [Junto] and attributed to the API user	Low
Remote-control task	Create a remote-control task for a device (MSP Anywhere / Take Control, RDP, VNC, or SSH) for the technician to launch from N-central	Medium
Set custom property	Change the value of a custom property on a device, or clear it	Medium
Control Windows services	Start, stop, restart, pause, or resume up to 10 services on a device	High
Run script	Run a catalogued script or automation policy on one device, as LocalSystem or with the device's stored credentials	High
Decommission device	Delete a device from N-central, by default also uninstalling its agent	High

All write actions require technician approval before execution. Read-only tools do not require approval. Running a script and decommissioning a device require approval from a user with the Manager role or above; controlling Windows services and setting custom properties require the Operator role or above. A technician without the required role can still request these actions, and the request is routed to a colleague with the right role to approve.

Scope and Reporting

• Customer context: Every tool operates on one mapped customer at a time. A device that belongs to another customer is reported as not found. Junto confirms the device belongs to the mapped customer before every read and again before every write.
• Inventory is a snapshot: Hardware, software, Windows services, network, and OS data come from the agent's last inventory, not a live query. Volumes report size only, with no free-space figure, and the services list shows startup type but not whether a service is currently running. Check the device's last check-in for freshness.
• Online state: A device is reported online when its agent checked in within the last 15 minutes. A device that checked in 20 minutes ago may be asleep rather than broken; ask for its monitor status to see the Agent Status module.
• Result limits: Device lists cover the whole customer roster, with a flag if the customer has more than 5,000 devices. Software searches across a customer scan up to 100 devices per request; narrow by device class or site on large fleets. Active issue lists return up to 500 issues.
• Warranty: When N-central's automatic warranty lookup does not support a manufacturer, the warranty date is blank rather than expired, and the lookup error is reported.
• Probes: Network probes have no asset inventory. Ask about the devices the probe discovered instead.
• Secrets: The agent never supplies custom credentials to a script, runs scripts with password-type inputs, or writes password-type custom properties.

Scripts, Services, and Remote Control

A script run returns an accepted task ID, not a finished result. Runs can take a minute or more to leave Pending; ask Junto to check the task status for the outcome and the script's output before treating it as complete. Service actions report the live state of each service after the action. Stopping or pausing a service interrupts whatever depends on it, so prefer a restart for a hung service.

A remote-control task does not produce a one-click link. Junto returns the session details, connection type, and connector download; the technician launches the session from the device in N-central or the connector. Check the device's remote-control state first, because a disconnected or unavailable device cannot be reached.

Decommissioning deletes the device's monitoring, history, and notes in N-central and cannot be undone. Re-enrolling creates a new device. Confirm the device name and last check-in first, and use it only for retired or replaced hardware.

If the connection, company mapping, or script catalog entry changes after approval, Junto stops the action and asks for fresh approval.

Example requests:

• "Find Acme's server FS01 in N-central and show whether it is online and which monitors are failing."
• "List the active N-central issues for Acme that nobody has acknowledged."
• "Which of Acme's devices have Java 8 installed?"
• "Show the hardware specs and warranty expiry for ACME-LT-042."
• "Restart the Spooler service on ACME-LT-042."
• "Run the Clear Print Queue script on ACME-LT-042, then check its output."
• "Add a note to ACME-LT-042 that the print spooler was restarted for ticket 48213."

Managing the Connection

• Update the token: Click Edit, paste the new token into User-API token, and click Update. Leave the field blank to keep the stored token. Junto tests the new token before saving and removes mappings to customers the new token cannot reach.
• Change servers: Click Edit, enter the new Server URL, and paste a token generated on that server. Customer IDs belong to one server, so saving a new server removes every company mapping and disables every catalogued script. Map companies again and re-check each script's repository ID on the new server before re-enabling it.
• Pause the integration: Click Edit, turn off Active, and click Update. The configuration, mappings, and script catalog remain saved.
• Remove the integration: Click Delete, then Delete in the confirmation dialog. This permanently removes the stored token, all N-central company mappings, and the script catalog from Junto.

Troubleshooting

• Connection fails: Recheck the Server URL (HTTPS, host only, no path) and the token. Confirm the API user still exists, is enabled and not locked, has two-factor authentication turned off, and does not have an expired password or a pending password reset. Regenerating the token in N-central revokes the previous one.
• Health shows a warning: The connection works, but the card names a problem with the API user that will soon break it, such as two-factor authentication or an expiring password. Fix it in N-central and click Test connection.
• Company or device missing: Confirm the configuration is active, the mapping is saved, and the API user has access to that customer in N-central. A device from an unmapped or different customer is reported as not found.
• Mapping dialog is empty or fails to load: Confirm the API user can see the intended customers, then close and reopen the dialog. If Junto shows no companies, import companies from your PSA first.
• Script is not available to the agent: Only catalogued, enabled scripts run. Check that the script is in the Script catalog, is Enabled, and has Enable API turned on in N-central. Bundled scripts must be cloned before they can be API-enabled.
• Script run reports a parameter error: The parameter names in the catalog must match the script's internal parameter names in N-central exactly, and every Required parameter needs a value.
• Script still pending: Runs can take a minute or more to start. Ask Junto to check the task status again rather than re-running the script.
• Service action rejected: Use the service's short name (such as Spooler), not its display name, and request no more than 10 services at once.
• Write action denied: All write actions require technician approval. Running scripts and decommissioning devices need a Manager or above to approve; service control and custom property changes need an Operator or above.