skip to main content

Nexthink Key Features

Want to solve issues before your end-users even know they exist? Want to save money on PC refresh cycles? Want to find out where your network's security weak points are? You'll want Nexthink, real-time end-user analytics for universities.

  • Universities can improve the technology refresh cycle by driving down operational and hardware costs, as well as ensuring that device requirements and replacement requirements are throughly understood.
  • Nexthink is the innovator of university end-user IT analytics for security, IT service management (ITSM) and workplace transformation.
  • Nexthink maps all the university IT services, how they're being consumed and how the IT infrastructure is operating, from the only perspective that matters most; the end-user's (students and workers).
  • Nexthink provides essential visibility and insight into university IT operations and security for IT Governance.

Nexthink's Architecture

The Nexthink architecture has been designed to simplify operations, ensure scaling and allow a rapid deployment. The system is composed of five main software components:

  • Nexthink Collector - used to capture information from all end-user devices
  • Nexthink Engine - aggregates Collector information and provides real-time IT analytics
  • Nexthink Finder - a rich search and analysis client for engines
  • Nexthink Portal - aggregates Engine info and provides dashboarding, reporting and long-term trending analytics
  • Nexthink Library - a cloud knowledge database

Nexthink Collector

The Collector is a lightweight agent implemented as a kernel driver. It captures network connections, program executions, web requests and many other kinds of activities and information from the devices of the end-users where it's installed. The Collector is based on a patented technology offering remote and automated silent installations and insignificant performance impact on local desktops (less than 0.015% CPU usage, 500k bytes memory) while minimizing network traffic (between 0.1 and 0.3 kbps).

The Collector is mainly a kernel driver, but it's made up of several components:

  • Driver - the core part of the Collector. It's responsible for gathering information about the devices and the activities of the end-users, and for sending them to the Engine.
  • Updater - an optional companion service that detects whether there's a new version of the Collector available for installation. If so, the Updater downloads and installs the new version on the end-user's device.
  • Control Panel extension - add this optional component to see the configuration of the Collector and be able to change it from the Control Panel of Windows.

Further features of the Collector:

  • CrashGuard. Since the Collector driver is a kernel-mode component, any error in its internals or its interaction with a misbehaving third-party driver can lead to system instabilities. Even if Nexthink put as much attention to deliver bug-free software as possible, the principle of precaution holds. The CrashGuard feature detects every system crash and it disables the Collector driver itself if the system crashes more than three times in a row after installation.
  • Kernel traffic interception. Some applications may send and receive data to and from the network using kernel-mode components, actually hiding their network traffic from user-space monitoring applications. Being a kernel driver itself, the Collector is nevertheless able to detect and report such traffic.
  • Paths aliasing. The Collector identifies commonly used paths (e.g. C:\WINDOWS\ or C:\ProgramFiles\) and other special mount locations (removable mount points, network drives) with paths aliases. For example, if the DVD-ROM drive is mounted under D:, the Collector reports an application setup.exe being launched from this media as RemovableDrive%\setup.exe.
  • Detection of Engine. The Collector driver is able to detect when the Engine isn't reachable in the local network. In this case, the Collector disables itself for 10 minutes.
  • Network interfaces supervision. The Collector dectects if a network interface appears on or disappears from the device where it's installed. In this case, the Collector driver resends the whole context to the Engine.
  • Windows Event logging. Main events and errors are logged in the standard Windows event logs.
  • On-the-fly configuration. The Collector driver parameters can be changed through the Collector Control Panel extension or the Collector Configuration tool. There's no need to restart the computer for changes to become effective.


  • Nexthink Engine is a high-performance analytics software capable of processing millions of endpoint activities in seconds.
  • Events sent in real time by Collectors populate the Engine with activity data, furnishing a rich repository of historical and live IT infrastructure usage data from the end-user perspective.
  • Engine leverages an in-memory database for rapid queries (via the Nexthink Finder) and flexible reporting (via the Nexthink Portal).


  • Nexthink Finder, built upon powerful visualization techniques, is the fastest search and user interface on the market to render visibility into your IT infrastructure.
  • You analyze IT services, query what you need within seconds, expand or drill-down the results in a few clicks to reveal swiftly, across the entire network, how many versions of a particular application are in use and on which workstations, the bandwidth consumed by the application, the servers and domains that the application accesses, the network response times and which users experienced issues and much more.


  • Nexthink Portal is the reporting tool, collaboration platform and centralized management platform of the Nexthink End-User IT analytics platform.
  • A comprehensive set of dashboards are delivered out-of-the-box, but it's possible in a matter of minutes to construct custom dashboards, valuable for anyone in the organization.
  • Personalized metrics are simple to define as drag-and-drop widgets, and can be quickly published and shared.
  • Nexthink Portal front-end is a web application running inside a browser.

Nexthink Library

  • Nexthink Library is an online knowledge database that gives you access to theme-based files, a large set of ready-to-use predefined investigations, reports, templates, dashboards and application information accessible directly from the Nexthink Finder and Portal.
  • Thanks to the full integration between Nexthink Library and Nexthink Engine, your infrastructure information is always fully up-to-date, without the need for any manual interaction.
  • Nexthink Library helps you to identify potential threats by submitting the digital footprint of any application found on a desktop or visited web domain to the Nexthink Library reference database.

Nexthink resources...

End User Analytics For Universities - Nexthink Demonstration
Tony Austwick
Tony Austwick

End User Analytics For Universities - Nexthink Demonstration

Nexthink provides the university IT management team with end-user analytics. Most monitoring services focus on the backend, things like servers and networks. Nexthink provides specific information relating to the end-user and for universities this approach provides an amazing insight on the student (and staff) IT experience.