Deploying Keeper to End-Users

Methods for deploying the Keeper app to end-user devices.

Compatibility

Keeper works on every smartphone, tablet and computer. Keeper supports popular browsers including Chrome, Safari, Firefox, Edge, Opera and IE. Native app installation is available from the Keeper website and every public-facing app store (iTunes, Google Play, Microsoft Store, etc).

Device

OS Version Supported

Windows

7 / 8 / 10+

Mac OS

Current Version - 2

Linux

Fedora, Red Hat, CentOS, Debian, Ubuntu, Mint

iOS

9+

Android

4.4+

Chrome OS

Current Version - 2

Internet Explorer

11

Edge

Current Version - 2

Safari

Current Version - 2

Firefox

Current Version - 2

Opera

Current Version - 2

The latest Keeper downloads can be found at https://keepersecurity.com/download

Keeper Web Vault

Many business and enterprise customers utilize the Keeper Web Vault, which is a fully featured web-based application. To access the Keeper Web Vault login, visit:

Keeper Desktop

Keeper Desktop is a cross-platform native desktop application for Windows, MacOS and Linux.

Benefits of Keeper Desktop App vs. Web Vault

The Desktop App (also referred to as our "Electron" app) has many more security benefits and feature capabilities over the Keeper Web Vault such as:

  • Ability to Autofill native apps using KeeperFill for Apps (eliminates the need for Copy/Paste)

  • Ability to automatically import existing passwords without additional component installation

  • Automatically migrate from existing LastPass vaults

  • Secure biometric login using Touch ID on compatible MacBook Pro computers

  • Secure biometric login using Windows Hello (Windows 10)

  • Windows Hello for Business, including biometrics and smart card capabilities (Windows 10)

  • Increased performance

  • Offline access (if enabled by Keeper Administrator)

  • Offline deployment via Microsoft Store

Microsoft Windows App Installer Distribution

The "Download for Windows 10" button on our download page links to the Microsoft "App Installer" package version of Keeper. This installer is optimized for Windows 10 and contains both 32- and 64-bit builds. We recommend installing this version when possible. The installer requires Windows Version 1809 and newer.

Please note: Windows Hello is only available on the App Installer distribution, Microsoft Store version, and Offline Microsoft Store installer version.

App Installer installs to:

  • User preferences is stored in: C:\Users\{user}\AppData\Local\Packages\KeeperSecurityInc.KeeperPasswordManager_xxx

  • The application binary is installed in: C:\Program Files\WindowsApps\KeeperSecurityInc.KeeperPasswordManager_xxx

To learn more about Microsoft App Installer distribution, see the below link: https://docs.microsoft.com/en-us/windows/msix/app-installer/app-installer-root

Microsoft Windows .MSI and .EXE Distributions

Minimum Requirements

Windows 7+. Pentium 4 or later that is SSE2 compatible. 512MB RAM.

Compatibility

For compatibility with older versions of Windows (7, 8 and pre-v1809 Windows 10), Keeper provides 64-bit EXE, 32-bit EXE and 32-bit .MSI distributions.

  • .MSI is for multi-user environments - supports multi-user or shared physical environments. This allows each user on a shared computer to have their own vault.

  • .MSI supports a silent install.

  • .EXE is for single user environments - one install per computer. Only one vault may be used per physical environment.

  • .EXE auto-updates, where .MSI does not.

.EXE installs to:

  • User preferences is stored in: C:\Users\{username}\AppData\Roaming\Keeper Password Manager\

  • The application binary is installed in: C:\Users\{username}\AppData\Local\keeperpasswordmanager\

.MSI installs to:

  • C:\Program Files\keeperpasswordmanager\

Command-Line Installer Options

The Keeper .MSI and .EXE installers support standard command-line switches. For example, you can install Keeper in silent mode.

.EXE Command-Line Switches

The Keeper .exe installer utilizes Inno Setup. Standard switches are documented here: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline

.MSI Command-Line Switches

The Keeper .MSI installer utilizes Microsoft Msiexec. Standard switches are documented here: https://docs.microsoft.com/en-us/windows/desktop/msi/standard-installer-command-line-options

Keeper Desktop for Mac OS

Minimum Requirements:

Mac OS 10.10+. Intel processor, 64-bit. 512MB RAM.

Download Link:

Note: Keeper for Mac OS also installs the KeeperFill Safari Extension.

Keeper Desktop for Linux

Minimum Requirements:

Fedora 28 or above Ubuntu LTS releases 16.04 or above Red Hat Enterprise Linux 7.0 or above CentOS version 7.3 and above Debian 8 and above Hardware: 512MB RAM

SHA1 Hash

Keeper Desktop SHA1 hashes are computed based on the most recent version and can be retrieved at the below URL: https://keepersecurity.com/desktop_electron/SHASUM256.txt

Browser Extensions (KeeperFill)

The Keeper browser extension components can be installed through direct links the various app stores:

Offline / Direct Downloads

If your group policy does not support installation of extensions, your SCCM administrator can use the below links to push the extensions or directly:

For Microsoft Store install of Keeper Desktop and Keeper Edge in "offline deployment" mode, please read the offline deployment section below.

Disabling Built-In Browser Password Managers

Often times, Enterprise customers would like to automatically disable the less secure, built-in password saving features of web browsers. There are several methods of managing this as described in this section.

Chrome for Enterprise

Google provides .adm and .admx files (.admx is a newer .xml file type) to make it easier to manage the Chrome browser using Group Policy. In G Suite and Chrome Enterprise environments, it is enabled via the Google Cloud platform using one of the below methods:

Mozilla Firefox for Enterprise

Similar to Chrome, Mozilla provides .adm and .admx files to manage Firefox using Group Policy. Mac-based systems are provided a .pkg file and are managed via JAMF, etc. Linux users are provided a policies.json file.

Microsoft Edge for Business

Edge for Business is now available for Windows and Mac. Group policy is managed through .adm and .admx files on Windows, and .plist on Mac.

Internet Explorer Mode for Edge

The new Edge for Business now supports "Internet Explorer Mode". We recommend using this mode for any IE browser requirements within your organization.

Legacy Internet Explorer

If legacy Internet Explorer is absolutely required by your users, management of password saving features can be disabled under traditional GPO found under:

User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer

Then disable “Turn on the auto-complete feature for user names and passwords.”

Microsoft Store "Offline" Deployment

To deploy a signed version of Keeper Password Manager or Keeper for Microsoft Edge extension to users without direct store installation, please follow the instructions below. Administrators should log in to the Microsoft Business Store from the link below:

https://businessstore.microsoft.com/

We publish two applications to the Microsoft Store - Keeper Password Manager and Keeper for Edge. Keeper Microsoft Store applications can be downloaded from the Microsoft Store for Business for offline deployment. A Microsoft account is required to log in. If the email address used is for an Azure domain the account must be authorized to access the store or be the primary admin on the Azure account.

Once logged in to the Microsoft Store for Business settings need to be changed in order to display offline downloads for an application. Select Manage from the top bar.

Then select Settings from the left pane.

Enable showing offline files under Shopping Experience. This will then show a drop down option for each application in the store when the application is enabled for offline deployment.

Search for Keeper in the store. Select the Keeper Password Manager or Keeper Edge application. A drop down menu will display titled License Type. The default selection will say Online. Change the drop down to the Offline option and select the Manage button.

The app will display with options to download.

Select the highest minimum version supported by the platforms where the deployment is intended. Select the Architecture and Language. The Download button next to Language will download a metadata file. This may be helpful for some deployment methodologies. Once the Minimum Version and language have been selected scroll down to the Package details section.

Download the package and the license file. Scroll past the License file section and download any Framework packages available for the application. For the Keeper Edge Extension no Frameworks are required. The application package does not include dependencies and cannot be deployed alone if Frameworks are required. Once the meta-data, package, framework and license files are downloaded they can be deployed through SCCM Manager. This MSDN blog post provides an example of how to create the application for deployment: https://blogs.msdn.microsoft.com/teju_shyamsundar/2016/05/30/deploy-an-application-from-windows-store-for-business-via-system-center-configuration-manager/

Mobile App Deployment

Keeper for mobile and tablet devices can be deployed through the public-facing app stores. MDM solutions can also push these applications to end-user devices without any special requirements. When the users register or sign into an account, Enterprise enforcement policies are automatically applied.

IE11 - Trusted Sites Policy

Customers who login to Keeper with SSO, or customers who are on corporate networks that deploy group policies for Internet Explorer, ensure that the following entries exist in your Trusted Sites settings under Tools > Internet Options > Security.

US / Global Customers (USA East/West):

keepersecurity.com

*.keepersecurity.com

EU Data Center Customers (Ireland, London, Frankfurt):

keepersecurity.eu

*.keepersecurity.eu

Enterprise customers must push group policies to end-users with these Trusted Sites in order to fully function with SSO and other critical features.

SSO Deployments

Keeper supports authentication, provisioning and deployment through your existing SAML 2.0 identity provider such as Azure AD, Okta, G Suite, Jumpcloud, Ping and many others. See the Keeper SSO Connect setup guide for deployment instructions.