Windows Installation

Overview

This document contains information on how to install, configure, and update your Keeper Gateway on Windows.

Prerequisite

Prior to proceeding with this document, make sure you generated a Keeper Gateway One-Time Access Token in your Vault. For more information, visit the following page:

Installation

Installation Path for Windows Executable

https://keepersecurity.com/pam/keeper-gateway_windows_x86.exe

Upon installation of the service, select "Enter a Keeper One-Time Access Token" and supply the token provided by the Gateway setup screen on the Vault. After installation, the service will automatically start up and register with the Keeper cloud.

For information on how to generate the Keeper One-Time Access Token for the gateway, visit this page

Installation Location

The default installation location is the following:

C:\ProgramFiles (x86)\Keeper Gateway\

Installing the Gateway as a Service

Keeper recommends that the Keeper Gateway is installed as a service.

After selecting the installation location, you will be prompted with the following:

Setup Options Details:

• Install Windows service - Installs the gateway as a window service

  • Use service account - If checked, use the specified service account, otherwise the account installing the gateway will be used

  • Start Windows service - if checked, start the Keeper Gateway service immediately after installation

• Turn on debug logging - Enable verbose logging on the gateway log files

Specifying the Keeper Gateway Service Account [Optional]

If "Use service account" is specified you will be prompted to enter the valid credentials of the desired service account:

Specifying the Keeper Gateway One Time Token

The final step prior to successfully installing the Keeper Gateway as service is to enter the One-Time Access Token:

After clicking "Next", click "Install" in the prompted screen to successfully install the Keeper Gateway.

Gateway Service Management

After installing and running the Keeper Gateway as a service, this service can be accessed and easily managed within the Windows Services Manager as "Keeper Gateway"

Keeper Gateway Configuration File

The Keeper Gateway configuration file contains a set of tokens that includes encryption keys, client identifiers, and destination server information used to authenticate and decrypt data from the Keeper Secrets Manager APIs. This configuration file is created from the Gateway One Time Access Tokens and have a one to one relationship with client devices.

If the Keeper Gateway is installed and running as a service, the gateway configuration file is stored in the following location:

C:\ProgramData\KeeperGateway\config\gateway-config.json

If the Keeper Gateway is installed locally and not running as a service, the gateway configuration file is stored in the following location:

C:\Users\<User>\.keeper\gateway-config.json

Keeper Gateway Log files

Logs that contain helpful debugging information are automatically created and stored on the local machine.

If the gateway is running as a service, the gateway log files are stored in the following location:

C:\ProgramData\KeeperGateway\logs\

If the gateway is not running as a service, the gateway log files are stored in the following location:

C:\Users\<User>\.keeper\logs\

Verbose Logging

To activate verbose logging:

• Go to Windows Services > Keeper Gateway > Properties

• Stop the service

• Set the "Start parameters" to: --debug or -d

• Start the service by clicking on "Start" Do not click "OK" without first starting the service as it will not persist the Parameter setting

Upgrading

To upgrade, stop the service, install the latest executable and then start the service.

• Back up your configuration .json file

• Uninstall Keeper Gateway from "Add and remove programs"

• Install Keeper Gateway (do not select "Enter a Keeper One-Time Access Token")

Auto Update

Configure your Keeper Gateway installation to automatically check for updates, ensuring it stays up-to-date with the latest version. For more information, refer to the following:

Silent Install

This section provides instructions for performing a silent installation of the Keeper Gateway on Windows systems. Silent installation allows the setup process to run in the background without displaying any user interface or messages.

Using the Silent Installation Command

To install Keeper Gateway silently, use the following command in your command prompt or script:

keeper-gateway_windows_x86.exe /verysilent /suppressmsgboxes /norestart /token=<YOUR ONE-TIME ACCESS TOKEN>

Replace <YOUR ONE-TIME ACCESS TOKEN> with the actual token generated for your Keeper Gateway installation.

Configuration Options

Existing Configuration: If you have previously installed Keeper Gateway and wish to use the existing configuration, you can bypass the token entry by using:

/existingconfig=1

The following other options may be used:

Installation Log File: To generate a log file during the installation process, use the following option and specify the desired log file path:

/log=<Optional log file>

Windows Service Account

If you prefer to run the Keeper Gateway under a specific Windows service account, use the following options to specify the account details:

/mergetasks="service/account" /serviceuser=<ACCOUNT USERNAME> /servicepass=<ACCOUNT PASSWORD>

Replace <ACCOUNT USERNAME> and <ACCOUNT PASSWORD> with the credentials of the service account you intend to use.

Auto Updater

To enable the Auto Updater feature, allowing Keeper Gateway to automatically check for and apply updates, use the following option:

/autoupdate=1

Uninstalling

To uninstall the service:

• Uninstall Keeper Gateway from "Add and remove programs"

• If desired, delete the private configuration .json file