Skip to main content
This page is for IT administrators who manage Windows machines centrally. It covers trusting the Nekt Power BI connector on many machines at once with Group Policy or Microsoft Intune, instead of running the trust command on each machine.
This applies only to AWS workspaces, which use Nekt’s custom connector. Nekt Express and GCP workspaces use the native Google BigQuery connector and need no extra configuration.

​
How trust works

The Nekt connector (nekt.pqx) is signed with Nekt’s certificate. Power BI Desktop loads it under the default Data Extensions security level when the certificate’s thumbprint is listed in this machine-wide registry value: The value is a list. If your organization already trusts other connectors, keep their thumbprints and add Nekt’s on its own line. For more on this mechanism, see Microsoft’s trusted third-party connectors documentation.

​
Group Policy

Use Group Policy Preferences to write the registry value on domain-joined computers.
1

Open the Group Policy Object

In Group Policy Management, create or edit a Group Policy Object (GPO) linked to the organizational unit that contains the computers running Power BI Desktop.
2

Add a registry item

Go to Computer Configuration → Preferences → Windows Settings → Registry. Right-click and select New → Registry Item.
3

Configure the registry item

  • Action: Update
  • Hive: HKEY_LOCAL_MACHINE
  • Key Path: SOFTWARE\Policies\Microsoft\Power BI Desktop
  • Value name: TrustedCertificateThumbprints
  • Value type: REG_MULTI_SZ
  • Value data: 95F982559840B15360B296E817A7ABFDC30A7EC5, plus any other thumbprints your organization trusts, one per line
Click OK.
4

Apply the policy

Computers apply the setting at the next Group Policy refresh. To apply it right away on a computer, run gpupdate /force, then restart Power BI Desktop.
Group Policy writes the whole list. Any thumbprints not included in Value data are removed from the machine, so list every certificate your organization trusts.

​
Microsoft Intune

Use an Intune platform script to add Nekt’s thumbprint on Microsoft Entra joined devices. The script keeps any thumbprints already trusted on the device.
1

Save the script

Save the following as Trust-NektPowerBIConnector.ps1:
2

Add the platform script

In the Microsoft Intune admin center, go to Devices → Scripts and remediations → Platform scripts → Add → Windows 10 and later. Give it a name, such as Trust Nekt Power BI connector.
3

Configure the script settings

  • Script location: upload Trust-NektPowerBIConnector.ps1
  • Run this script using the logged on credentials: No, so the script runs as SYSTEM and can write to HKEY_LOCAL_MACHINE
  • Enforce script signature check: No, unless you sign the script with your organization’s certificate
  • Run script in 64-bit PowerShell host: Yes
4

Assign the script

Assign the script to the device groups that run Power BI Desktop, then select Add. Intune runs the script once per device. Users need to restart Power BI Desktop afterward.

​
Distribute the connector file

Trust is configured per machine, but Power BI Desktop loads custom connectors from each user’s Documents folder:
Users can download nekt.pqx themselves, as described in the Power BI setup guide. To distribute it centrally, run a script in the user’s context, such as an Intune platform script with Run this script using the logged on credentials set to Yes:
The script removes older Nekt connector files before downloading the latest version, so only one Nekt connector loads. It uses GetFolderPath('MyDocuments') so it also works when Documents is redirected to OneDrive. To pin a specific version, replace the URL with one from the version list.

​
Verify

On a managed machine, run this in PowerShell. The output should include 95F982559840B15360B296E817A7ABFDC30A7EC5:
Then open Power BI Desktop with Data Extensions set to (Recommended) Only allow Microsoft certified and other trusted third-party extensions to load. Nekt should appear in Get Data, and no “Uncertified connectors” dialog should appear.

​
Certificate renewal

Nekt’s current signing certificate is valid until December 31, 2029. Before it expires, Nekt will publish the new certificate’s thumbprint. Add the new thumbprint next to the current one, so connectors signed with either certificate load during the transition.