# Device Management Commands
### Overview
Keeper Commander provides comprehensive device management capabilities for both individual users and enterprise administrators. These commands allow you to list, manage, and perform actions on devices.
{% hint style="info" %}
**What's a Device?** A device represents a unique Keeper vault client, such as a web browser, iOS, Android, Desktop App, Commander service or any other instance running Keeper software. A web browser in "incognito" mode is considered as a different device.
{% endhint %}
### **User Commands**
These allow individual users to manage their own registered devices:
* **`device-list`** – View a list of devices associated with your account.
* **`device-action`** – Take actions on your devices, such as logout, remove, link, unlink, account-lock, account-unlock, lock or unlock.
* **`device-rename`** – Rename your device for easier identification.
These commands give users **full control over their own devices**, allowing them to monitor and manage device access securely — from anywhere. Whether you're on a desktop, laptop, or mobile, you can manage your registered devices without needing access to these devices.
### **Enterprise Commands**
These are available to administrators for managing devices across all enterprise users that they have rights over:
* **`device-admin-list`** – View devices linked to any enterprise user.
* **`device-admin-action`** – Perform administrative actions on a user’s device, such as logout, remove, lock, unlock, or account-specific actions like account-lock/account-unlock.
With these commands, admins can enforce security policies, remotely manage user devices, and maintain visibility across the organization.
### Terminology
The below table describes the device terminology used in Keeper's platform.
| Terminology | Description |
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Remove a device** | The user is logged out from the device, and the device is removed from further usage. |
| **Lock/Unlock a device** | **All users** that are using a specific device will be unable to login to that device. For example if multiple users are registered with a single device. |
| **Account Lock/Unlock a device** | The specified user is prevented from logging in to a device, but the device still exists and can be unlocked. |
| **Logout a device** | The session for the user is expired and the user must re-authenticate on the device. |
| **Link a device** | When two or more devices are linked, logging into one device will activate the session for the other devices. Logout of one device logs out both devices.
Note: Device linking requires that the user account has "Stay Logged In" activated (also referred to as persistent login). See the this-device command to enable persistent login.
|
***
### User Device Commands
#### `device-list` - List Your Devices
Lists all active devices for the current user.
**Command Syntax**
```
device-list [--format=FORMAT] [--output=FILE]
```
**Parameters**
* `--format`: Output format (table or json). Default: table
* `--output`: Output file name (ignored for table format)
**Examples**
**Example 1: Display devices in table format**
```
My Vault> device-list
User Devices (3 found)
ID Device Name Client Type Login Status Last Accessed
1 My iPhone IOS LOGGED_IN 2025-01-15 10:30:25
2 Work Laptop CHROME_EXTENSION LOGGED_IN 2025-01-15 09:15:42
3 Home Desktop DESKTOP LOGGED_OUT 2025-01-14 18:22:15
```
**Example 2: Display devices list as JSON**
```
My Vault> device-list --format=json
{
"devices": [
{
"id": 1,
"deviceName": "My iPhone",
"clientType": "IOS",
"loginStatus": "LOGGED_IN",
"lastAccessedTimestamp": "2025-01-15 10:30:25"
},
{
"id": 2,
"deviceName": "Work Laptop",
"clientType": "CHROME_EXTENSION",
"loginStatus": "LOGGED_IN",
"lastAccessedTimestamp": "2025-01-15 09:15:42"
}
]
}
```
**Example 3: Save JSON to file**
```
My Vault> device-list --format=json --output=my_devices.json
Results saved to my_devices.json
```
***
#### `device-action` - Perform Actions on Your Devices
Perform various actions on your own devices such as logout, lock, or link devices together.
**Command Syntax**
```
device-action
```
**Getting Action-Specific Help**
```
My Vault> device-action -h
```
***
### Device Action Commands
#### `device-action logout` - Logout from Devices
Logout the user from specified devices remotely.
**Command Syntax**
```
device-action logout
```
**Parameters**
* `DEVICES`: Device IDs (1, 2, 3...) or device names to logout
**Getting Help**
```
My Vault> device-action logout -h
usage: device-action logout [-h] devices [devices ...]
Logout the user from the device
positional arguments:
devices Device IDs (1, 2, 3...) or device names to logout from
options:
-h, --help show this help message and exit
```
**Examples**
**Example 1: Logout from a device by ID**
```
My Vault> device-action logout 1
✓ Device 'My iPhone' successfully logged out
Updated device list:
User Devices (3 found)
ID Device Name Client Type Login Status Last Accessed
1 My iPhone IOS LOGGED_OUT 2025-01-15 10:35:12
2 Work Laptop CHROME_EXTENSION LOGGED_IN 2025-01-15 09:15:42
3 Home Desktop DESKTOP LOGGED_OUT 2025-01-14 18:22:15
```
**Example 2: Logout from a device by name**
```
My Vault> device-action logout "My iPhone"
✓ Device 'My iPhone' successfully logged out
```
**Example 3: Logout from multiple devices**
```
My Vault> device-action logout 1 2
✓ Device 'My iPhone' successfully logged out
✓ Device 'Work Laptop' successfully logged out
```
***
#### `device-action remove` - Remove Devices
Logout and remove devices from your account completely.
**Command Syntax**
```
device-action remove
```
**Parameters**
* `DEVICES`: Device IDs (1, 2, 3...) or device names to remove user from
**Getting Help**
```
My Vault> device-action remove -h
usage: device-action remove [-h] devices [devices ...]
Logout & Remove the user from that device
positional arguments:
devices Device IDs (1, 2, 3...) or device names to remove user from
options:
-h, --help show this help message and exit
```
**Examples**
**Example 1: Remove a device by ID**
```
My Vault> device-action remove 1
✓ Device 'My iPhone' successfully removed
Updated device list:
User Devices (2 found)
ID Device Name Client Type Login Status Last Accessed
2 Work Laptop CHROME_EXTENSION LOGGED_IN 2025-01-15 09:15:42
3 Home Desktop DESKTOP LOGGED_OUT 2025-01-14 18:22:15
```
**Example 2: Remove multiple devices by name**
```
My Vault> device-action remove "My iPhone" "Home Desktop"
✓ Device 'My iPhone' successfully removed
✓ Device 'Home Desktop' successfully removed
```
***
#### `device-action lock` - Lock Devices
Lock devices for all users and logout all users from the device.
**Command Syntax**
```
device-action lock
```
**Parameters**
* `DEVICES`: Device IDs (1, 2, 3...) or device names to lock
**Getting Help**
```
My Vault> device-action lock -h
usage: device-action lock [-h] devices [devices ...]
Lock the device for all users on the devices and the associated auto linked devices. Logout all users from the device
positional arguments:
devices Device IDs (1, 2, 3...) or device names to lock
options:
-h, --help show this help message and exit
```
**Examples**
**Example 1: Lock a device by name**
```
My Vault> device-action lock "Work Laptop"
✓ Device 'Work Laptop' successfully locked
```
**Example 2: Lock multiple devices by ID**
```
My Vault> device-action lock 1 2
✓ Device 'My iPhone' successfully locked
✓ Device 'Work Laptop' successfully locked
```
***
#### `device-action unlock` - Unlock Devices
Unlock devices and associated auto-linked devices for the calling user.
**Command Syntax**
```
device-action unlock
```
**Parameters**
* `DEVICES`: Device IDs (1, 2, 3...) or device names to unlock
**Getting Help**
```
My Vault> device-action unlock -h
usage: device-action unlock [-h] devices [devices ...]
Unlock the devices and the associated auto linked devices for the calling user
positional arguments:
devices Device IDs (1, 2, 3...) or device names to unlock
options:
-h, --help show this help message and exit
```
**Examples**
**Example 1: Unlock multiple devices**
```
My Vault> device-action unlock 1 2
✓ Device 'My iPhone' successfully unlocked
✓ Device 'Work Laptop' successfully unlocked
```
***
#### `device-action account-lock` - Account Lock Devices
Lock the device for the calling user only. If the user is logged in, logout the user.
**Command Syntax**
```
device-action account-lock
```
**Parameters**
* `DEVICES`: Device IDs (1, 2, 3...) or device names to account-lock
**Getting Help**
```
My Vault> device-action account-lock -h
usage: device-action account-lock [-h] devices [devices ...]
Lock the device for the calling user only. If calling user is logged in, logout the calling user.
positional arguments:
devices Device IDs (1, 2, 3...) or device names to account-lock
options:
-h, --help show this help message and exit
```
**Examples**
**Example 1: Account-lock a device**
```
My Vault> device-action account-lock "My iPhone"
✓ Device 'My iPhone' successfully account-locked
```
***
#### `device-action account-unlock` - Account Unlock Devices
Unlock the device for the calling user.
**Command Syntax**
```
device-action account-unlock
```
**Parameters**
* `DEVICES`: Device IDs (1, 2, 3...) or device names to account-unlock
**Getting Help**
```
My Vault> device-action account-unlock -h
usage: device-action account-unlock [-h] devices [devices ...]
Unlock the device for the calling user.
positional arguments:
devices Device IDs (1, 2, 3...) or device names to account-unlock
options:
-h, --help show this help message and exit
```
**Examples**
**Example 1: Account-unlock a device**
```
My Vault> device-action account-unlock 1
✓ Device 'My iPhone' successfully account-unlocked
```
***
#### `device-action link` - Link Devices
Link multiple devices together. When two devices are linked, logging into one device will activate the session for the other device, only if the session is resumable (persistent login or "Stay Logged In" has been activated for the account). Logout of one device logs out both devices.
**Command Syntax**
```
device-action link
```
**Parameters**
* `DEVICES`: Device IDs (1, 2, 3...) or device names to link together
**Examples**
**Example 1: Link multiple devices by ID**
```
My Vault> device-action link 1 2 3
✓ Device 'My iPhone' successfully linked
✓ Device 'Work Laptop' successfully linked
✓ Device 'Home Desktop' successfully linked
Updated device list:
User Devices (3 found)
ID Device Name Client Type Login Status Last Accessed
1 My iPhone IOS LOGGED_IN 2025-01-15 10:40:25
2 Work Laptop CHROME_EXTENSION LOGGED_IN 2025-01-15 10:40:25
3 Home Desktop DESKTOP LOGGED_IN 2025-01-15 10:40:25
```
**Example 2: Link devices by name**
```
My Vault> device-action link "My iPhone" "Work Laptop"
✓ Device 'My iPhone' successfully linked
✓ Device 'Work Laptop' successfully linked
```
***
#### `device-rename` - Rename Your Devices
Rename your devices to more descriptive (friendly) names.
**Command Syntax**
```
device-rename
```
**Parameters**
* `DEVICE`: Device ID (1, 2, 3...) or device name
* `NEW_NAME`: New name for the device
**Examples**
**Example 1: Rename device by ID**
```
My Vault> device-rename 1 "My New iPhone"
✓ Device name updated from 'My iPhone' to 'My New iPhone'
Updated device list:
User Devices (3 found)
ID Device Name Client Type Login Status Last Accessed
1 My New iPhone IOS LOGGED_IN 2025-01-15 10:40:33
2 Work Laptop CHROME_EXTENSION LOGGED_IN 2025-01-15 09:15:42
3 Home Desktop DESKTOP LOGGED_OUT 2025-01-14 18:22:15
```
**Example 2: Rename device by name**
```
My Vault> device-rename "Work Laptop" "Updated Work Laptop"
✓ Device name updated from 'Work Laptop' to 'Updated Work Laptop'
```
***
### Enterprise Device Commands
**Note**: Enterprise device commands require administrator privileges and are available in the Enterprise section of the help menu.
{% hint style="warning" %}
Enterprise device commands are not be available in the production environment until October 2025
{% endhint %}
#### `device-admin-list` - List All User Devices (Admin)
List all devices across users that the Admin has control of.
**Command Syntax**
```
device-admin-list [--format=FORMAT] [--output=FILE]
```
**Parameters**
* `ENTERPRISE_USER_IDS`: List of Enterprise User IDs (required)
* `--format`: Output format (table or json). Default: table
* `--output`: Output file name (ignored for table format)
**How to Get Enterprise User IDs**
```
My Vault> ei --users
Enterprise Users
ID Email Status Name
123456 john@company.com Active John Doe
789012 jane@company.com Active Jane Smith
345678 bob@company.com Locked Bob Johnson
```
**Examples**
**Example 1: List devices for specific users**
```
My Vault> device-admin-list 123456 789012
Admin Device List (5 devices found)
ID Enterprise User ID Device Name UI Category Device Status Login Status Last Accessed
1 123456 iPhone 12 iOS App OK LOGGED_IN 2025-01-15 10:30:25
2 123456 Chrome Browser Browser Extension OK LOGGED_IN 2025-01-15 09:15:42
3 789012 Android Phone Android App OK LOGGED_OUT 2025-01-14 18:22:15
4 789012 Work Desktop Desktop OK LOGGED_IN 2025-01-15 08:45:33
5 789012 Web Browser Web Vault OK LOGGED_IN 2025-01-15 11:22:18
```
**Example 2: List devices for single user**
```
My Vault> device-admin-list 123456
Admin Device List (2 devices found)
ID Enterprise User ID Device Name UI Category Device Status Login Status Last Accessed
1 123456 iPhone 12 iOS App OK LOGGED_IN 2025-01-15 10:30:25
2 123456 Chrome Browser Browser Extension OK LOGGED_IN 2025-01-15 09:15:42
```
**Example 3: List devices to JSON**
```
My Vault> device-admin-list 123456 --format=json
{
"devices": [
{
"id": 1,
"enterpriseUserId": 123456,
"deviceName": "iPhone 12",
"uiCategory": "iOS App",
"deviceStatus": "OK",
"loginStatus": "LOGGED_IN",
"lastAccessedTimestamp": "2025-01-15 10:30:25"
},
{
"id": 2,
"enterpriseUserId": 123456,
"deviceName": "Chrome Browser",
"uiCategory": "Browser Extension",
"deviceStatus": "OK",
"loginStatus": "LOGGED_IN",
"lastAccessedTimestamp": "2025-01-15 09:15:42"
}
]
}
```
**Example 4: Save to file**
```
My Vault> device-admin-list 123456 789012 --format=json --output=admin_devices.json
Results saved to admin_devices.json
```
***
#### `device-admin-action` - Perform Actions on User Devices (Admin)
Perform various actions on one or more devices that the Admin has control of.
**Command Syntax**
```
device-admin-action
```
**Getting Action-Specific Help**
```
My Vault> device-admin-action -h
```
***
### Admin Device Action Commands
#### `device-admin-action logout` - Admin Logout Users
Logout users from their devices as an administrator.
**Command Syntax**
```
device-admin-action logout
```
**Parameters**
* `ENTERPRISE_USER_ID`: Enterprise User ID whose devices to act on
* `DEVICES`: Device IDs (1, 2, 3...) or device names to logout from
**Getting Help**
```
My Vault> device-admin-action logout -h
usage: device-admin-action logout [-h] enterprise_user_id devices [devices ...]
Logout the user from the device
positional arguments:
enterprise_user_id Enterprise User ID whose devices to act on
devices Device IDs (1, 2, 3...) or device names to logout from
options:
-h, --help show this help message and exit
```
**Examples**
**Example 1: Logout user from specific device**
```
My Vault> device-admin-action logout 123456 1
✓ Device action successfully completed: 'iPhone 12' logged out for user 123456
Updated device list for user 123456:
User Devices (2 found)
ID Device Name UI Category Device Status Login Status Last Accessed
1 iPhone 12 iOS App OK LOGGED_OUT 2025-01-15 10:45:12
2 Chrome Browser Browser Extension OK LOGGED_IN 2025-01-15 09:15:42
```
**Example 2: Logout user from multiple devices**
```
My Vault> device-admin-action logout 123456 1 2
✓ Device action successfully completed: 2 devices logged out for user 123456
```
***
#### `device-admin-action remove` - Admin Remove User Devices
Remove users from their devices.
**Command Syntax**
```
device-admin-action remove
```
**Examples**
**Example 1: Remove user from device**
```
My Vault> device-admin-action remove 123456 "iPhone 12"
✓ Device action successfully completed: 'iPhone 12' removed for user 123456
```
***
#### `device-admin-action lock` - Admin Lock User Devices
Lock user devices as an administrator.
**Command Syntax**
```
device-admin-action lock
```
**Examples**
**Example 1: Lock user's device by name**
```
My Vault> device-admin-action lock 789012 "Work Desktop"
✓ Device action successfully completed: 'Work Desktop' locked for user 789012
```
***
#### `device-admin-action unlock` - Admin Unlock User Devices
Unlock user devices as an administrator.
**Command Syntax**
```
device-admin-action unlock
```
**Examples**
**Example 1: Unlock user's device**
```
My Vault> device-admin-action unlock 789012 3
✓ Device action successfully completed: 'Android Phone' unlocked for user 789012
```
***
#### `device-admin-action account-lock` - Admin Account Lock
Account-lock specific user devices as an administrator.
**Command Syntax**
```
device-admin-action account-lock
```
**Examples**
**Example 1: Account-lock specific user device**
```
My Vault> device-admin-action account-lock 123456 "iPhone 12"
✓ Device action successfully completed: 'iPhone 12' account locked for user 123456
```
***
#### `device-admin-action account-unlock` - Admin Account Unlock
Account-unlock user devices as an administrator.
**Command Syntax**
```
device-admin-action account-unlock
```
**Examples**
**Example 1: Account-unlock user device**
```
My Vault> device-admin-action account-unlock 123456 1
✓ Device action successfully completed: 'iPhone 12' account unlocked for user 123456
```
***
For more information about Keeper Commander, visit the [Commander CLI Documentation](https://docs.keeper.io/keeperpam/commander-cli).