# Device Management Commands

### Overview <a href="#overview" id="overview"></a>

Keeper Commander provides comprehensive device management capabilities for both individual users and enterprise administrators. These commands allow you to list, manage, and perform actions on devices.

{% hint style="info" %}
**What's a Device?** A device represents a unique Keeper vault client, such as a web browser, iOS, Android, Desktop App, Commander service or any other instance running Keeper software. A web browser in "incognito" mode is considered as a different device.
{% endhint %}

### **User Commands**

These allow individual users to manage their own registered devices:

* **`device-list`** – View a list of devices associated with your account.
* **`device-action`** – Take actions on your devices, such as logout, remove, link, unlink, account-lock, account-unlock, lock or unlock.
* **`device-rename`** – Rename your device for easier identification.

These commands give users **full control over their own devices**, allowing them to monitor and manage device access securely — from anywhere. Whether you're on a desktop, laptop, or mobile, you can manage your registered devices without needing access to these devices.

### **Enterprise Commands**

These are available to administrators for managing devices across all enterprise users that they have rights over:

* **`device-admin-list`** – View devices linked to any enterprise user.
* **`device-admin-action`** – Perform administrative actions on a user’s device, such as logout, remove, lock, unlock, or account-specific actions like account-lock/account-unlock.

With these commands, admins can enforce security policies, remotely manage user devices, and maintain visibility across the organization.

### Terminology

The below table describes the device terminology used in Keeper's platform.

| Terminology                      | Description                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Remove a device**              | The user is logged out from the device, and the device is removed from further usage.                                                                                                                                                                                                                                                                                                                                                             |
| **Lock/Unlock a device**         | **All users** that are using a specific device will be unable to login to that device. For example if multiple users are registered with a single device.                                                                                                                                                                                                                                                                                         |
| **Account Lock/Unlock a device** | The specified user is prevented from logging in to a device, but the device still exists and can be unlocked.                                                                                                                                                                                                                                                                                                                                     |
| **Logout a device**              | The session for the user is expired and the user must re-authenticate on the device.                                                                                                                                                                                                                                                                                                                                                              |
| **Link a device**                | <p>When two or more devices are linked, logging into one device will activate the session for the other devices. Logout of one device logs out both devices.</p><p></p><p><strong>Note:</strong> Device linking requires that the user account has "Stay Logged In" activated (also referred to as persistent login). See the <a href="../misc-commands#this-device-command"><code>this-device</code></a> command to enable persistent login.</p> |

***

### User Device Commands <a href="#user-device-commands" id="user-device-commands"></a>

#### `device-list` - List Your Devices <a href="#device-list---list-your-devices" id="device-list---list-your-devices"></a>

Lists all active devices for the current user.

**Command Syntax**

```
device-list [--format=FORMAT] [--output=FILE]
```

**Parameters**

* `--format`: Output format (table or json). Default: table
* `--output`: Output file name (ignored for table format)

**Examples**

**Example 1: Display devices in table format**

```
My Vault> device-list
User Devices (3 found)
ID  Device Name      Client Type     Login Status  Last Accessed
1   My iPhone         IOS              LOGGED_IN     2025-01-15 10:30:25
2   Work Laptop       CHROME_EXTENSION LOGGED_IN     2025-01-15 09:15:42
3   Home Desktop      DESKTOP          LOGGED_OUT    2025-01-14 18:22:15
```

**Example 2: Display devices list as JSON**

```
My Vault> device-list --format=json
{
  "devices": [
    {
      "id": 1,
      "deviceName": "My iPhone",
      "clientType": "IOS",
      "loginStatus": "LOGGED_IN",
      "lastAccessedTimestamp": "2025-01-15 10:30:25"
    },
    {
      "id": 2,
      "deviceName": "Work Laptop",
      "clientType": "CHROME_EXTENSION",
      "loginStatus": "LOGGED_IN",
      "lastAccessedTimestamp": "2025-01-15 09:15:42"
    }
  ]
}
```

**Example 3: Save JSON to file**

```
My Vault> device-list --format=json --output=my_devices.json
Results saved to my_devices.json
```

***

#### `device-action` - Perform Actions on Your Devices <a href="#device-action---perform-actions-on-your-devices" id="device-action---perform-actions-on-your-devices"></a>

Perform various actions on your own devices such as logout, lock, or link devices together.

**Command Syntax**

```
device-action <ACTION> <Device ID / Device Name>
```

**Getting Action-Specific Help**

```
My Vault> device-action <ACTION> -h
```

***

### Device Action Commands <a href="#device-action-commands" id="device-action-commands"></a>

#### `device-action logout` - Logout from Devices <a href="#device-action-logout---logout-from-devices" id="device-action-logout---logout-from-devices"></a>

Logout the user from specified devices remotely.

**Command Syntax**

```
device-action logout <Device ID / Device Name>
```

**Parameters**

* `DEVICES`: Device IDs (1, 2, 3...) or device names to logout

**Getting Help**

```
My Vault> device-action logout -h
usage: device-action logout [-h] devices [devices ...]

Logout the user from the device

positional arguments:
  devices     Device IDs (1, 2, 3...) or device names to logout from

options:
  -h, --help  show this help message and exit
```

**Examples**

**Example 1: Logout from a device by ID**

```
My Vault> device-action logout 1
✓ Device 'My iPhone' successfully logged out

Updated device list:
User Devices (3 found)
ID  Device Name        Client Type      Login Status  Last Accessed
1   My iPhone         IOS              LOGGED_OUT    2025-01-15 10:35:12
2   Work Laptop       CHROME_EXTENSION LOGGED_IN     2025-01-15 09:15:42
3   Home Desktop      DESKTOP          LOGGED_OUT    2025-01-14 18:22:15
```

**Example 2: Logout from a device by name**

```
My Vault> device-action logout "My iPhone"
✓ Device 'My iPhone' successfully logged out
```

**Example 3: Logout from multiple devices**

```
My Vault> device-action logout 1 2
✓ Device 'My iPhone' successfully logged out
✓ Device 'Work Laptop' successfully logged out
```

***

#### `device-action remove` - Remove Devices <a href="#device-action-remove---remove-devices" id="device-action-remove---remove-devices"></a>

Logout and remove devices from your account completely.

**Command Syntax**

```
device-action remove <Device ID / Device Name>
```

**Parameters**

* `DEVICES`: Device IDs (1, 2, 3...) or device names to remove user from

**Getting Help**

```
My Vault> device-action remove -h
usage: device-action remove [-h] devices [devices ...]

Logout & Remove the user from that device

positional arguments:
  devices     Device IDs (1, 2, 3...) or device names to remove user from

options:
  -h, --help  show this help message and exit
```

**Examples**

**Example 1: Remove a device by ID**

```
My Vault> device-action remove 1
✓ Device 'My iPhone' successfully removed

Updated device list:
User Devices (2 found)
ID  Device Name        Client Type      Login Status  Last Accessed
2   Work Laptop       CHROME_EXTENSION LOGGED_IN     2025-01-15 09:15:42
3   Home Desktop      DESKTOP          LOGGED_OUT    2025-01-14 18:22:15
```

**Example 2: Remove multiple devices by name**

```
My Vault> device-action remove "My iPhone" "Home Desktop"
✓ Device 'My iPhone' successfully removed
✓ Device 'Home Desktop' successfully removed
```

***

#### `device-action lock` - Lock Devices <a href="#device-action-lock---lock-devices" id="device-action-lock---lock-devices"></a>

Lock devices for all users and logout all users from the device.

**Command Syntax**

```
device-action lock <Device ID / Device Name>
```

**Parameters**

* `DEVICES`: Device IDs (1, 2, 3...) or device names to lock

**Getting Help**

```
My Vault> device-action lock -h
usage: device-action lock [-h] devices [devices ...]

Lock the device for all users on the devices and the associated auto linked devices. Logout all users from the device

positional arguments:
  devices     Device IDs (1, 2, 3...) or device names to lock

options:
  -h, --help  show this help message and exit
```

**Examples**

**Example 1: Lock a device by name**

```
My Vault> device-action lock "Work Laptop"
✓ Device 'Work Laptop' successfully locked
```

**Example 2: Lock multiple devices by ID**

```
My Vault> device-action lock 1 2
✓ Device 'My iPhone' successfully locked
✓ Device 'Work Laptop' successfully locked
```

***

#### `device-action unlock` - Unlock Devices <a href="#device-action-unlock---unlock-devices" id="device-action-unlock---unlock-devices"></a>

Unlock devices and associated auto-linked devices for the calling user.

**Command Syntax**

```
device-action unlock <Device ID / Device Name>
```

**Parameters**

* `DEVICES`: Device IDs (1, 2, 3...) or device names to unlock

**Getting Help**

```
My Vault> device-action unlock -h
usage: device-action unlock [-h] devices [devices ...]

Unlock the devices and the associated auto linked devices for the calling user

positional arguments:
  devices     Device IDs (1, 2, 3...) or device names to unlock

options:
  -h, --help  show this help message and exit
```

**Examples**

**Example 1: Unlock multiple devices**

```
My Vault> device-action unlock 1 2
✓ Device 'My iPhone' successfully unlocked
✓ Device 'Work Laptop' successfully unlocked
```

***

#### `device-action account-lock` - Account Lock Devices <a href="#device-action-account-lock---account-lock-devices" id="device-action-account-lock---account-lock-devices"></a>

Lock the device for the calling user only. If the user is logged in, logout the user.

**Command Syntax**

```
device-action account-lock <Device ID / Device Name>
```

**Parameters**

* `DEVICES`: Device IDs (1, 2, 3...) or device names to account-lock

**Getting Help**

```
My Vault> device-action account-lock -h
usage: device-action account-lock [-h] devices [devices ...]

Lock the device for the calling user only. If calling user is logged in, logout the calling user.

positional arguments:
  devices     Device IDs (1, 2, 3...) or device names to account-lock

options:
  -h, --help  show this help message and exit
```

**Examples**

**Example 1: Account-lock a device**

```
My Vault> device-action account-lock "My iPhone"
✓ Device 'My iPhone' successfully account-locked
```

***

#### `device-action account-unlock` - Account Unlock Devices <a href="#device-action-account-unlock---account-unlock-devices" id="device-action-account-unlock---account-unlock-devices"></a>

Unlock the device for the calling user.

**Command Syntax**

```
device-action account-unlock <Device ID / Device Name>
```

**Parameters**

* `DEVICES`: Device IDs (1, 2, 3...) or device names to account-unlock

**Getting Help**

```
My Vault> device-action account-unlock -h
usage: device-action account-unlock [-h] devices [devices ...]

Unlock the device for the calling user.

positional arguments:
  devices     Device IDs (1, 2, 3...) or device names to account-unlock

options:
  -h, --help  show this help message and exit
```

**Examples**

**Example 1: Account-unlock a device**

```
My Vault> device-action account-unlock 1
✓ Device 'My iPhone' successfully account-unlocked
```

***

#### `device-action link` - Link Devices <a href="#device-action-link---link-devices" id="device-action-link---link-devices"></a>

Link multiple devices together. When two devices are linked, logging into one device will activate the session for the other device, only if the session is resumable (persistent login or "Stay Logged In" has been activated for the account). Logout of one device logs out both devices.

**Command Syntax**

```
device-action link <Device ID / Device Name>
```

**Parameters**

* `DEVICES`: Device IDs (1, 2, 3...) or device names to link together

**Examples**

**Example 1: Link multiple devices by ID**

```
My Vault> device-action link 1 2 3
✓ Device 'My iPhone' successfully linked
✓ Device 'Work Laptop' successfully linked
✓ Device 'Home Desktop' successfully linked

Updated device list:
User Devices (3 found)
ID  Device Name        Client Type      Login Status  Last Accessed
1   My iPhone         IOS              LOGGED_IN     2025-01-15 10:40:25
2   Work Laptop       CHROME_EXTENSION LOGGED_IN     2025-01-15 10:40:25
3   Home Desktop      DESKTOP          LOGGED_IN     2025-01-15 10:40:25
```

**Example 2: Link devices by name**

```
My Vault> device-action link "My iPhone" "Work Laptop"
✓ Device 'My iPhone' successfully linked
✓ Device 'Work Laptop' successfully linked
```

***

#### `device-rename` - Rename Your Devices <a href="#device-rename---rename-your-devices" id="device-rename---rename-your-devices"></a>

Rename your devices to more descriptive (friendly) names.

**Command Syntax**

```
device-rename <Device ID / Device Name> <NEW_NAME>
```

**Parameters**

* `DEVICE`: Device ID (1, 2, 3...) or device name
* `NEW_NAME`: New name for the device

**Examples**

**Example 1: Rename device by ID**

```
My Vault> device-rename 1 "My New iPhone"
✓ Device name updated from 'My iPhone' to 'My New iPhone'

Updated device list:
User Devices (3 found)
ID  Device Name        Client Type      Login Status  Last Accessed
1   My New iPhone     IOS              LOGGED_IN     2025-01-15 10:40:33
2   Work Laptop       CHROME_EXTENSION LOGGED_IN     2025-01-15 09:15:42
3   Home Desktop      DESKTOP          LOGGED_OUT    2025-01-14 18:22:15
```

**Example 2: Rename device by name**

```
My Vault> device-rename "Work Laptop" "Updated Work Laptop"
✓ Device name updated from 'Work Laptop' to 'Updated Work Laptop'
```

***

### Enterprise Device Commands <a href="#enterprise-device-commands" id="enterprise-device-commands"></a>

**Note**: Enterprise device commands require administrator privileges and are available in the Enterprise section of the help menu.

{% hint style="warning" %}
Enterprise device commands are not be available in the production environment until October 2025
{% endhint %}

#### `device-admin-list` - List All User Devices (Admin) <a href="#device-admin-list---list-all-user-devices-admin" id="device-admin-list---list-all-user-devices-admin"></a>

List all devices across users that the Admin has control of.

**Command Syntax**

```
device-admin-list <ENTERPRISE_USER_IDS> [--format=FORMAT] [--output=FILE]
```

**Parameters**

* `ENTERPRISE_USER_IDS`: List of Enterprise User IDs (required)
* `--format`: Output format (table or json). Default: table
* `--output`: Output file name (ignored for table format)

**How to Get Enterprise User IDs**

```
My Vault> ei --users
Enterprise Users
ID       Email                    Status    Name
123456   john@company.com         Active    John Doe  
789012   jane@company.com         Active    Jane Smith
345678   bob@company.com          Locked    Bob Johnson
```

**Examples**

**Example 1: List devices for specific users**

```
My Vault> device-admin-list 123456 789012
Admin Device List (5 devices found)
ID  Enterprise User ID  Device Name     UI Category        Device Status  Login Status  Last Accessed
1   123456             iPhone 12       iOS App            OK             LOGGED_IN     2025-01-15 10:30:25
2   123456             Chrome Browser  Browser Extension  OK             LOGGED_IN     2025-01-15 09:15:42
3   789012             Android Phone   Android App        OK             LOGGED_OUT    2025-01-14 18:22:15
4   789012             Work Desktop    Desktop            OK             LOGGED_IN     2025-01-15 08:45:33
5   789012             Web Browser     Web Vault          OK             LOGGED_IN     2025-01-15 11:22:18
```

**Example 2: List devices for single user**

```
My Vault> device-admin-list 123456
Admin Device List (2 devices found)
ID  Enterprise User ID  Device Name     UI Category        Device Status  Login Status  Last Accessed
1   123456             iPhone 12       iOS App            OK             LOGGED_IN     2025-01-15 10:30:25
2   123456             Chrome Browser  Browser Extension  OK             LOGGED_IN     2025-01-15 09:15:42
```

**Example 3: List devices to JSON**

```
My Vault> device-admin-list 123456 --format=json
{
  "devices": [
    {
      "id": 1,
      "enterpriseUserId": 123456,
      "deviceName": "iPhone 12",
      "uiCategory": "iOS App",
      "deviceStatus": "OK",
      "loginStatus": "LOGGED_IN",
      "lastAccessedTimestamp": "2025-01-15 10:30:25"
    },
    {
      "id": 2,
      "enterpriseUserId": 123456,
      "deviceName": "Chrome Browser",
      "uiCategory": "Browser Extension",
      "deviceStatus": "OK",
      "loginStatus": "LOGGED_IN",
      "lastAccessedTimestamp": "2025-01-15 09:15:42"
    }
  ]
}
```

**Example 4: Save to file**

```
My Vault> device-admin-list 123456 789012 --format=json --output=admin_devices.json
Results saved to admin_devices.json
```

***

#### `device-admin-action` - Perform Actions on User Devices (Admin) <a href="#device-admin-action---perform-actions-on-user-devices-admin" id="device-admin-action---perform-actions-on-user-devices-admin"></a>

Perform various actions on one or more devices that the Admin has control of.

**Command Syntax**

```
device-admin-action <ACTION> <ENTERPRISE_USER_ID> <Device ID / Device Name>
```

**Getting Action-Specific Help**

```
My Vault> device-admin-action <ACTION> -h
```

***

### Admin Device Action Commands <a href="#admin-device-action-commands" id="admin-device-action-commands"></a>

#### `device-admin-action logout` - Admin Logout Users <a href="#device-admin-action-logout---admin-logout-users" id="device-admin-action-logout---admin-logout-users"></a>

Logout users from their devices as an administrator.

**Command Syntax**

```
device-admin-action logout <ENTERPRISE_USER_ID> <Device ID / Device Name>
```

**Parameters**

* `ENTERPRISE_USER_ID`: Enterprise User ID whose devices to act on
* `DEVICES`: Device IDs (1, 2, 3...) or device names to logout from

**Getting Help**

```
My Vault> device-admin-action logout -h
usage: device-admin-action logout [-h] enterprise_user_id devices [devices ...]

Logout the user from the device

positional arguments:
  enterprise_user_id  Enterprise User ID whose devices to act on
  devices             Device IDs (1, 2, 3...) or device names to logout from

options:
  -h, --help          show this help message and exit
```

**Examples**

**Example 1: Logout user from specific device**

```
My Vault> device-admin-action logout 123456 1
✓ Device action successfully completed: 'iPhone 12' logged out for user 123456

Updated device list for user 123456:
User Devices (2 found)
ID  Device Name     UI Category        Device Status  Login Status  Last Accessed
1   iPhone 12       iOS App            OK             LOGGED_OUT    2025-01-15 10:45:12
2   Chrome Browser  Browser Extension  OK             LOGGED_IN     2025-01-15 09:15:42
```

**Example 2: Logout user from multiple devices**

```
My Vault> device-admin-action logout 123456 1 2
✓ Device action successfully completed: 2 devices logged out for user 123456
```

***

#### `device-admin-action remove` - Admin Remove User Devices <a href="#device-admin-action-remove---admin-remove-user-devices" id="device-admin-action-remove---admin-remove-user-devices"></a>

Remove users from their devices.

**Command Syntax**

```
device-admin-action remove <ENTERPRISE_USER_ID> <Device ID / Device Name>
```

**Examples**

**Example 1: Remove user from device**

```
My Vault> device-admin-action remove 123456 "iPhone 12"
✓ Device action successfully completed: 'iPhone 12' removed for user 123456
```

***

#### `device-admin-action lock` - Admin Lock User Devices <a href="#device-admin-action-lock---admin-lock-user-devices" id="device-admin-action-lock---admin-lock-user-devices"></a>

Lock user devices as an administrator.

**Command Syntax**

```
device-admin-action lock <ENTERPRISE_USER_ID> <Device ID / Device Name>
```

**Examples**

**Example 1: Lock user's device by name**

```
My Vault> device-admin-action lock 789012 "Work Desktop"
✓ Device action successfully completed: 'Work Desktop' locked for user 789012
```

***

#### `device-admin-action unlock` - Admin Unlock User Devices <a href="#device-admin-action-unlock---admin-unlock-user-devices" id="device-admin-action-unlock---admin-unlock-user-devices"></a>

Unlock user devices as an administrator.

**Command Syntax**

```
device-admin-action unlock <ENTERPRISE_USER_ID> <Device ID / Device Name>
```

**Examples**

**Example 1: Unlock user's device**

```
My Vault> device-admin-action unlock 789012 3
✓ Device action successfully completed: 'Android Phone' unlocked for user 789012
```

***

#### `device-admin-action account-lock` - Admin Account Lock <a href="#device-admin-action-account-lock---admin-account-lock" id="device-admin-action-account-lock---admin-account-lock"></a>

Account-lock specific user devices as an administrator.

**Command Syntax**

```
device-admin-action account-lock <ENTERPRISE_USER_ID> <Device ID / Device Name>
```

**Examples**

**Example 1: Account-lock specific user device**

```
My Vault> device-admin-action account-lock 123456 "iPhone 12"
✓ Device action successfully completed: 'iPhone 12' account locked for user 123456
```

***

#### `device-admin-action account-unlock` - Admin Account Unlock <a href="#device-admin-action-account-unlock---admin-account-unlock" id="device-admin-action-account-unlock---admin-account-unlock"></a>

Account-unlock user devices as an administrator.

**Command Syntax**

```
device-admin-action account-unlock <ENTERPRISE_USER_ID> <Device ID / Device Name>
```

**Examples**

**Example 1: Account-unlock user device**

```
My Vault> device-admin-action account-unlock 123456 1
✓ Device action successfully completed: 'iPhone 12' account unlocked for user 123456

```

***

For more information about Keeper Commander, visit the [Commander CLI Documentation](https://docs.keeper.io/en/keeperpam/commander-cli/).
