# Deployment
## Overview Deploying Endpoint Privilege Manager is very simple. The admin creates a custom deployment package associated to a collection of endpoints, and pushes the Keeper agent to those endpoints. When the agent starts up, it immediately registers itself with the Keeper tenant and starts collecting basic information about the endpoint, including the executables and local user accounts. By default, the Keeper agent goes into a "monitoring" mode, and no action is taken. #### There are two main parts: 1. **Create a deployment package** in the Keeper Admin Console 2. **Install and register the agent** on endpoints Once complete, the device can receive policies and report activity. #### The Core Deployment Workflow All deployment methods follow the same steps: 1. Create deployment package 2. Install agent 3. Register endpoint 4. Assign to collections 5. Validate deployment ### Requirements * **macOS**: Sequoia, Sonoma * **Linux**: Ubuntu 22.04+ * **Windows**: 11, Server 2022 and 2025 (Intel x64 Only) ### Encryption All communications between the Keeper Agent and the Keeper Admin Console are using end-to-end encryption with a zero knowledge architecture, which means that Keeper's servers and employees have no ability to decrypt any information about the endpoint. Only the Keeper Administrator who logs in to the Admin Console can decrypt the endpoint collections and associated metadata. ### Deployment Package From the **Endpoint Privilege Manager** > **Deployments** screen, select "**New Deployment Package**". The Keeper agent can be deployed to any Windows, macOS or Linux endpoint. The executable requires local admin privilege to install the agent. For automatic deployment through your remote management solution or group policy, push out the installer in silent mode using the provided command-line string. ### Deployment Collections When creating a deployment package, the assigned "Collection" name is referenced throughout the privilege manager when applying policies. The collection name typically refers to a group of users sharing a common platform or use case.
## Agent Deployment From the Admin Console UI, copy the installer zip file and download it to your machine. Unzip the file to extract the packages for each specific platform. Copy the deployment token for use in the installer command. A valid deployment token is required to register the Keeper Agent to your tenant. {% hint style="danger" %} Always verify the Keeper agent in your sandbox or non-production test environment before installing directly on production systems. {% endhint %} See the [Command Line Policy](/en/keeperpam/endpoint-privilege-manager/policies/policy-types/command-line-policy-type.md) documentation for configuration and usage instructions. * The Keeper Agent will launch for users upon a new login session. Therefore logout/login may be required. * The `sudo` policy controls are documented on the [Command Line Policy](/en/keeperpam/endpoint-privilege-manager/policies/policy-types/command-line-policy-type.md) page. * Installation of packages (.pkg) and images (.dmg) requires that the user explicitly opens the request from the Keeper agent UI. ## Discovery of Inventory Data #### Inventory Collection Schedules **Basic (inventory-basic / InventoryBasic):** runs every 7200 minutes (5 days); also runs on AgentRegistered and Startup\ **User (user-inventory / UserInventory):** runs every 7200 minutes (5 days); also runs on AgentRegistered and Startup\ **Application (file-inventory / FileInventory):** runs every 7200 minutes (5 days); also runs on Startup only (no AgentRegistered trigger) #### **Details** **Schedule:** All three use the same interval: intervalMinutes: 7200 (120 hours = 5 days).\ Basic and User also run on:\ **AgentRegistered –** when the agent registers with the backend\ **Startup –** when the agent starts\ Application (file inventory) runs on the same 5‑day interval and on Startup only; it does not have an AgentRegistered trigger. User, Application, and Basic all run on a 5‑day (7200‑minute) schedule; Basic and User additionally run on agent registration and startup. When the agent is installed and deployed to the endpoints, there are 3 types of discovery that is performed on the endpoint: * **Basic Inventory**: Operating system, version, type * **Account Inventory**: Local users and groups * **File Inventory**: All executables on the system The Keeper Admin Console will receive the discovered inventory as encrypted telemetry data, containing information about the endpoint including: * Computer name and type * OS information (Windows, macOS, Linux) and version * Local user account information * Local group account information * Installed applications {% hint style="info" %} When deploying Keeper, we recommend installing the agent on reference machines in order to collect as much standardized inventory data as possible, before deploying to your fleet of devices. {% endhint %} The Deployment page displays the endpoint stats organized by collection.

Deployment Dashboard

The collection can be enabled or disabled from the dashboard. When a collection is disabled, the policy engine will no longer apply to those devices.

Enable or Disable Collections of Endpoints

Individual endpoints can also be disabled, to prevent the agent from applying policies.

Enable or Disable individual endpoints

## Automation with Commander Keeper Commander supports deployment automation through our command-line interface, Service Mode [REST API](/en/keeperpam/commander-cli/service-mode-rest-api.md) and Python SDK. [Learn more](/en/keeperpam/commander-cli/command-reference/endpoint-privilege-manager-commands.md) about Endpoint Privilege Manager commands. ### Agent Management The `epm agent` command provides management over individual agents running on the endpoint. ``` My Vault> epm agent -h pedm command [--options] Command Description ---------- ------------------------- list List EPM agents edit Update EPM agents delete Delete EPM agents collection List EPM agent resources ``` ### Deployment The `epm deployment` command provides management over agent deployments. ``` My Vault> epm deployment -h pedm command [--options] Command Description --------- -------------------------------- list List EPM deployments add Add EPM deployments update Update EPM deployment delete Delete EPM deployment download Download EPM deployment package ``` ### Reports The `epm report` command provides event logs and event reports. ``` My Vault> epm report -h pedm command [--options] Command Description --------- ----------------------------- column Run column reports event Run audit event reports summary Run audit summary reports ``` ## Antivirus / EDR Exclusion Requirements When deploying Keeper Endpoint Privilege Manager alongside third‑party antivirus or EDR solutions, the EPM installation directory should be excluded from real‑time scanning. This prevents performance degradation and avoids interference with policy evaluation, process interception, and privilege‑elevation workflows. ### Required Exclusion Path ``` C:\Program Files\Keeper Security\Endpoint Privilege Manager\Plugins\bin\KeeperUSession ``` ### Product‑Specific Instructions **Microsoft Defender**\ Run in elevated PowerShell: ``` Add-MpPreference -ExclusionPath 'C:\Program Files\Keeper Security\Endpoint Privilege Manager' ``` **CrowdStrike Falcon**\ Falcon Console → Endpoint Security → Configure → Exclusions → Add folder path (include subfolders)\ \ **SentinelOne**\ Management Console → Sentinels → Exclusions → Add Path Exclusion\ Mode: Interoperability – Extended (include subfolders)\ \ **Sophos Central**\ Global Settings → Global Exclusions → Add Exclusion → File or Folder (Windows)\ Apply to real‑time and scheduled scanning If you experience CallerCheck alerts on you endpoints, you can exclude them with the specific thumbprint of the event:\ Global Settings → Global Exclusions → Add Exclusion → Detected Exploits (Windows/Mac) → `` (same across machines but unique per Sophos account).\ \ **Symantec/Broadcom SEP**\ SEPM Console → Policies → Exceptions → Add Windows Exception → Folder (include subfolders)\ \ **Trend Micro Apex One**\ Apex Central or local console → Scan Exclusion List → Add directory ### GPO Deployment (Microsoft Defender) ``` Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Exclusions → Path Exclusions ``` **Add:** *C:\Program Files\Keeper Security\Endpoint Privilege Manager* **with a value of 0.** ## **Suggested Deployment Phases** Successfully deploying Privileged Elevation and Delegation Management (PEDM) requires a phased approach that balances security with operational continuity. This guide outlines the recommended strategy for implementing Keeper's Endpoint Privilege Manager across your organization. ### Phase 1: **Validate in a Production-Like Test Environment** Before rolling KEPM out broadly, deploy it to a small set of **test machines that closely match your production endpoints** (same OS versions, device types, security baselines, and installed applications). Use this pilot to confirm that KEPM installs cleanly, policy enforcement behaves as expected, and there are **no conflicts with existing security or management tools** (such as EDR/XDR agents, antivirus, application control, DLP, VPN clients, or device management utilities). In many environments, successful rollout requires creating **exclusions/allowlists** in other security tools so KEPM components can operate normally (for example, folder/process/network or script execution exclusions). Identify and document any required exclusions during this phase, then standardize and deploy them through your existing security management platform **before** expanding KEPM to additional endpoints. ### Phase 2: Foundation and Discovery #### Start with Monitor Mode Begin your deployment by setting all policies to **Monitor** mode. This allows you to understand baseline privilege usage without disrupting user workflows. * Deploy the Keeper agent to a pilot group of endpoints (10-20% of your environment) * Set all initial policies to "Monitor" mode to observe privilege elevation patterns * Allow 1-2 weeks for comprehensive data collection * Focus on diverse endpoint types: developer workstations, standard user machines, and servers

Monitor Mode Policy

#### Analyze Privilege Usage Patterns During the monitoring phase, examine the dashboard for: * **Frequent elevation requests**: Applications and processes that regularly require admin privileges * **User behavior patterns**: Which users need elevated access and when * **Legitimate business processes**: Operations that require admin rights for valid reasons * **Anomalous activity**: Unusual privilege requests that may indicate security risks

Monitoring Mode

#### Establish Collections and Organizational Structure Create meaningful collections based on your findings: * **User Groups**: Organize by role (Developers, IT Staff, Standard Users, Executives) * **Machine Collections**: Group by function (Development Workstations, Servers, Kiosks) * **Application Collections**: Categorize business-critical vs. administrative tools * **Custom Collections**: Create specific groups for unique organizational needs ### Phase 3: Gradual Policy Implementation #### Begin with Monitor & Notify Transition key policies from Monitor to **Monitor & Notify** mode: * Start with less critical applications and user groups * Focus on policies that showed consistent patterns during monitoring * Allow users to adapt to notifications before enforcement begins * Communicate changes to affected users in advance #### Implement Basic Controls Introduce foundational security measures with minimal user friction: * **Justification Requirements**: Start with simple justification policies for standard elevation requests * **Time-based Restrictions**: Apply stricter policies outside business hours * **Application-specific Policies**: Control access to high-risk or unnecessary administrative tools #### Test Approval Workflows For sensitive operations, implement approval-based policies: * Begin with a small group of trusted approvers * Test approval workflows with non-critical applications first * Establish clear escalation procedures and timeframes * Ensure 24/7 coverage for business-critical approvals ### Phase 4: Enforcement and Least Privilege #### Implement Least Privilege Gradually Deploy the core least privilege model in phases: * **Pilot Group**: Start with 10-20 volunteer users from IT or security teams * **Low-Risk Users**: Expand to users with minimal admin needs * **Standard Users**: Remove local admin rights from general workforce * **Power Users**: Work with developers and IT staff to refine their specific needs #### Deploy MFA Requirements Add multi-factor authentication for sensitive operations: * Prioritize MFA for high-risk applications and system modifications * Ensure users are enrolled in Keeper vaults with appropriate 2FA methods * Provide clear setup instructions and support resources * Test MFA workflows during off-hours and emergency scenarios #### Establish Advanced Policy Controls Implement sophisticated policy combinations: * **Layered Policies**: Apply multiple policies to the same resources for defense-in-depth * **Conditional Access**: Use date/time windows for varying security levels * **Application-specific Controls**: Fine-tune policies based on application behavior * **File Access Controls**: Protect sensitive executables and system files ### Phase 5: Optimization and Full Deployment #### Scale to Full Environment Expand to your complete endpoint fleet: * Deploy in batches of 100-200 endpoints per week * Monitor system performance and user feedback * Adjust policies based on operational requirements * Maintain emergency bypass procedures for critical situations #### Continuous Monitoring and Refinement Establish ongoing operational practices: * **Weekly Reviews**: Analyze elevation requests and policy effectiveness * **Monthly Assessments**: Review and adjust policies based on business changes * **Quarterly Audits**: Comprehensive evaluation of privilege management effectiveness * **Annual Policy Reviews**: Update policies to reflect organizational changes ### Key Success Factors #### Communication and Training * Provide clear documentation on new processes and expectations * Offer training sessions for end users on the new privilege model * Establish help desk procedures for privilege-related issues * Create self-service resources for common elevation requests #### Technical Considerations * Ensure network connectivity for agent communication * Plan for offline policy evaluation capabilities * Implement proper logging and alerting for security events * Establish backup procedures for critical system access #### Policy Design Best Practices * **Start Restrictive**: Apply the most restrictive policy when multiple policies conflict * **Granular Controls**: Use specific application and user targeting rather than broad policies * **Business Alignment**: Align policies with actual business processes and risk tolerance * **Regular Updates**: Keep policies current with changing business needs and threat landscape #### Emergency Procedures * Maintain emergency break-glass procedures for critical system access * Document escalation paths for urgent privilege requests * Establish clear criteria for temporary policy suspension * Ensure 24/7 contact information for emergency approvals ### Common Pitfalls to Avoid * **Rushing Implementation**: Take time to understand usage patterns before enforcing policies * **Over-Engineering**: Start simple and add complexity gradually * **Insufficient Communication**: Keep users informed throughout the deployment process * **Ignoring Business Impact**: Consider operational requirements when designing policies * **Lack of Monitoring**: Continuously monitor and adjust based on real-world usage ### Measuring Success Track these key metrics to evaluate deployment effectiveness: * **Reduction in Standing Admin Rights**: Percentage of users removed from local admin groups * **Policy Compliance**: Adherence to established privilege management policies * **User Satisfaction**: Feedback on process efficiency and user experience * **Security Incidents**: Reduction in privilege-related security events * **Operational Efficiency**: Time to resolution for legitimate privilege requests By following this phased approach, organizations can successfully deploy Endpoint Privilege Manager while maintaining operational continuity and user satisfaction. The key is to move gradually, monitor continuously, and adjust based on real-world usage patterns and feedback. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.keeper.io/en/keeperpam/endpoint-privilege-manager/deployment.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.