Deployment

Overview

Deploying Endpoint Privilege Manager is very simple. The admin creates a custom deployment package associated to a collection of endpoints, and pushes the Keeper agent to those endpoints. When the agent starts up, it immediately registers itself with the Keeper tenant and starts collecting basic information about the endpoint, including the executables and local user accounts. By default, the Keeper agent goes into a "monitoring" mode, and no action is taken.

Requirements

• macOS: Sequoia, Sonoma, Tahoe

• Linux: RedHat 9.4+, Ubuntu 20.04+, Amazon Linux 2, Rocky Linux 9+, Debian 11, 12, SUSE 15sp 2+, AlmaLinux 9.4+

• Windows: 11, Server 2022 and 2025 (Intel x64 Only)

Encryption

All communications between the Keeper Agent and the Keeper Admin Console are using end-to-end encryption with a zero knowledge architecture, which means that Keeper's servers and employees have no ability to decrypt any information about the endpoint. Only the Keeper Administrator who logs in to the Admin Console can decrypt the endpoint collections and associated metadata.

Deployment Package

From the Endpoint Privilege Manager > Deployments screen, select "New Deployment Package". The Keeper agent can be deployed to any Windows, macOS or Linux endpoint. The executable requires local admin privilege to install the agent. For automatic deployment through your remote management solution or group policy, push out the installer in silent mode using the provided command-line string.

Deployment Collections

When creating a deployment package, the assigned "Collection" name is referenced throughout the privilege manager when applying policies. The collection name typically refers to a group of users sharing a common platform or use case.

Agent Deployment

From the Admin Console UI, copy the installer zip file and download it to your machine. Unzip the file to extract the packages for each specific platform. Copy the deployment token for use in the installer command. A valid deployment token is required to register the Keeper Agent to your tenant.

The below documentation covers installation and configuration of the Keeper agent:

Windows installation

Tips:

• Ensure that the Keeper Endpoint Privilege Manager service is running.

• You may need to update your endpoint security product to allow Keeper Privilege Manager services to run.

• The Keeper Client application will start up automatically on all new login sessions for users on the machine.

Troubleshooting on Windows

To restart the Endpoint Privilege Manager services, we recommend simply rebooting the machine. The service can also be restarted from Services.

The log files are located in:

Uninstall on Windows

To uninstall the Windows agent:

To manually register an agent that has already been installed, the below can be invoked:

Linux Installation

Linux sudo usage

After installation, Keeper modifies the PAM module on the device to wrap sudo. Any usage of the sudo command is delegated to keepersudo.

See the documentation for configuration and usage instructions.

Updating

To update the Agent that has already been registered:

To identify which version is running:

Troubleshooting on Linux

Error logs will be located in /var/log/syslog or /var/log/messages depending on the flavor of Linux.

To restart the services:

Uninstall on Linux

Uninstalling the Keeper agent varies based on the platform and the install method used above.

Ubuntu / Debian-based distributions:

To remove and purge all configuration file:

RPM-based distributions:

On RHEL / Rocky / Alma / CentOS / Oracle Linux:

To manually register an agent that has already been installed, the below can be invoked:

macOS Installation

To manually register an agent that has already been installed, the below can be invoked:

Restarting the service

If a service restart is required on macOS, the following commands can be used:

Uninstall on macOS

To uninstall the Keeper agent from macOS, run the attached script:

Notes:

• The Keeper Agent will launch for users upon a new login session. Therefore logout/login may be required.

• The sudo policy controls are documented on the page.

• Installation of packages (.pkg) and images (.dmg) requires that the user explicitly opens the request from the Keeper agent UI.

Discovery of Inventory Data

When the agent is installed and deployed to the endpoints, there are 3 types of discovery that is performed on the endpoint:

• Basic Inventory: Operating system, version, type

• Account Inventory: Local users and groups

• File Inventory: All executables on the system

The Keeper Admin Console will receive the discovered inventory as encrypted telemetry data, containing information about the endpoint including:

• Computer name and type

• OS information (Windows, macOS, Linux) and version

• Local user account information

• Local group account information

The Deployment page displays the endpoint stats organized by collection.

The collection can be enabled or disabled from the dashboard. When a collection is disabled, the policy engine will no longer apply to those devices.

Individual endpoints can also be disabled, to prevent the agent from applying policies.

Automation with Commander

Keeper Commander supports deployment automation through our command-line interface, Service Mode and Python SDK. about Endpoint Privilege Manager commands.

Agent Management

The pedm agent command provides management over individual agents running on the endpoint.

Deployment

The pedm deployment command provides management over agent deployments.

Reports

The pedm report command provides event logs and event reports.

Next Steps

Once you have deployed the agent, discovery kicks in and generates .