> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/device-commands/device-admin-commands.md).

# Device Admin Commands

Admin commands for managing devices across enterprise users

### Overview

These commands let enterprise administrators view and manage devices for users they control.

{% hint style="warning" %}
Enterprise device commands require administrator privileges.
{% endhint %}

* [Device Admin List](#device-admin-list-command)
* [Device Admin Logout](#device-admin-logout-command)
* [Device Admin Remove](#device-admin-remove-command)
* [Device Admin Lock](#device-admin-lock-command)
* [Device Admin Unlock](#device-admin-unlock-command)
* [Device Admin Account-lock](#device-admin-account-lock-command)
* [Device Admin Account-unlock](#device-admin-account-unlock-command)

### Device Admin List

Lists devices for one or more enterprise users.

<details>

<summary>DotNet CLI</summary>

**Command :** `device-admin-list [user] [--format <table|json>]`

**Parameters**

<table><thead><tr><th width="278">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>user</code></td><td>Enterprise user email, user ID, or <code>"all"</code>. If omitted, lists devices for every enterprise user.</td></tr><tr><td><code>--format</code></td><td>Output format: <code>table</code> (default) or <code>json</code>.</td></tr></tbody></table>

**Examples**

{% code expandable="true" %}

```csharp
# List devices for a single enterprise user
My vault> device-admin-list user@company.com

# List devices for every enterprise user
My vault> device-admin-list all

# List devices for a user as JSON
My vault> device-admin-list user@company.com --format json

```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command** : `Get-KeeperAdminUserDevice [[-User] <String>] [-Format <String>]`

**Parameters**

<table><thead><tr><th width="239">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-User</code></td><td>Enterprise user email or ID. If omitted (or <code>"all"</code>), lists devices for every enterprise user.</td></tr><tr><td><code>-Format</code></td><td><code>table</code> (default) or <code>json</code>.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```ps1
# List devices for a single enterprise user
PS > Get-KeeperAdminUserDevice -User "user@company.com"

# List devices for every enterprise user
PS > Get-KeeperAdminUserDevice

# List devices for a user as JSON
PS > Get-KeeperAdminUserDevice -User "user@company.com" -Format json
```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command:** `device-admin-list`

**Parameters:**

* `enterprise_user_ids` One or more enterprise user IDs
* `--format` Output format. Values: `table` or `json`. Default: `table`
* `--output` Output file name. Ignored for `table` format

**Example:**

```bash
My Vault> device-admin-list 123456 789012
Admin Device List (5 devices found)
ID  Enterprise User ID  Device Name     UI Category        Device Status  Login Status  Last Accessed
1   123456              iPhone 12       iOS App            OK             LOGGED_IN     2025-01-15 10:30:25
2   123456              Chrome Browser  Browser Extension  OK             LOGGED_IN     2025-01-15 09:15:42
3   789012              Android Phone   Android App        OK             LOGGED_OUT    2025-01-14 18:22:15
4   789012              Work Desktop    Desktop            OK             LOGGED_IN     2025-01-15 08:45:33
5   789012              Web Browser     Web Vault          OK             LOGGED_IN     2025-01-15 11:22:18
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `list_admin_devices`

**Parameters:**

* `keeper_auth_context` Logged-in `KeeperAuth` session
* `enterprise_user_ids` One or more enterprise user IDs

**Example:**

```python
from keepersdk.authentication import device_management

enterprise_user_ids = [37585258XXXX, 37585258XXXX]

devices = device_management.list_admin_devices(keeper_auth_context, enterprise_user_ids)

for d in devices:
    print(
        d.list_index,
        d.enterprise_user_id,
        d.name,
        d.ui_category,
        d.device_status,
        d.login_status,
        d.last_accessed,
    )
```

</details>

### Device Admin Logout

Log out a user from selected device.

<details>

<summary>DotNet CLI</summary>

**Command :** `device-admin-action logout <user> <devices> [--yes]`

**Parameters**

<table><thead><tr><th width="250">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>user</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>devices</code></td><td>Comma-separated device identifiers. Accepts: <code>id:&#x3C;prefix></code> (device ID prefix), <code>name:&#x3C;text></code> (device name substring), <code>#&#x3C;row></code> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or <code>"all"</code>.</td></tr><tr><td><code>--yes</code></td><td>Skips the confirmation prompt shown before <code>remove</code>, <code>lock</code>, and <code>account-lock</code>. Use for unattended/scripted runs.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
# Logout a device by ID prefix, skipping confirmation
My Vault> device-admin-action logout user@company.com id:a1b2c3 --yes

# Log out two devices by row number (non-destructive action, no prompt)
My Vault> device-admin-action logout user@company.com "#1,#3"
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command** : `Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]`

**Parameters**

<table><thead><tr><th width="236">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>-User</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>-Devices</code></td><td>Device ID(s), device name(s), <code>id:&#x3C;prefix></code>, <code>name:&#x3C;text></code>, <code>#&#x3C;row></code> (row number from <code>Get-KeeperAdminUserDevice</code> for this user), or <code>"all"</code>. Accepts a comma-separated string or an array of strings.</td></tr><tr><td><code>-Confirm</code> / <code>-WhatIf</code></td><td>Standard PowerShell <code>ShouldProcess</code> switches. <code>remove</code>, <code>lock</code>, and <code>account-lock</code> prompt for confirmation by default (<code>ConfirmImpact = High</code>); pass <code>-Confirm:$false</code> to skip the prompt in scripts, or <code>-WhatIf</code> to preview without acting.</td></tr></tbody></table>

Identifiers that match more than one device are reported as ambiguous and skipped, unless `"all"` is specified.

**Examples**

{% code expandable="true" %}

```ps1
# Logout device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action logout -User "user@company.com" -Devices "1"

```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command:** `device-admin-action logout`

**Parameters:**

* `enterprise_user_id` Enterprise user ID
* `device` Device ID from `device-admin-list` or exact device name

**Example:**

```bash
My Vault> device-admin-action logout 123456 1
✓ Device action successfully completed: 'iPhone 12' logged out for user 123456
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `logout_admin_user_devices`

**Parameters:**

* `keeper_auth_context` Logged-in `KeeperAuth` session
* `enterprise_user_id` Enterprise user ID
* `device_identifiers` One or more device IDs or exact device names

**Example:**

```python
from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXXX
device_identifiers = ['1']  # or ['My Commander CLI']

names = device_management.logout_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)
for name in names:
    print(f"Device '{name}' logged out for user {enterprise_user_id}")
```

</details>

### Device Admin Remove

Removes a selected device from a user account.

<details>

<summary>DotNet CLI</summary>

**Command :** `device-admin-action remove <user> <devices> [--yes]`

**Parameters**

<table><thead><tr><th width="250">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>user</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>devices</code></td><td>Comma-separated device identifiers. Accepts: <code>id:&#x3C;prefix></code> (device ID prefix), <code>name:&#x3C;text></code> (device name substring), <code>#&#x3C;row></code> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or <code>"all"</code>.</td></tr><tr><td><code>--yes</code></td><td>Skips the confirmation prompt shown before <code>remove</code>, <code>lock</code>, and <code>account-lock</code>. Use for unattended/scripted runs.</td></tr></tbody></table>

**Examples**

{% code expandable="true" %}

```csharp
# removeadevice by ID prefix, skipping confirmation
My Vault> device-admin-action remove user@company.com id:a1b2c3 --yes

```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command** : `Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]`

**Parameters**

<table><thead><tr><th width="236">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>-User</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>-Devices</code></td><td>Device ID(s), device name(s), <code>id:&#x3C;prefix></code>, <code>name:&#x3C;text></code>, <code>#&#x3C;row></code> (row number from <code>Get-KeeperAdminUserDevice</code> for this user), or <code>"all"</code>. Accepts a comma-separated string or an array of strings.</td></tr><tr><td><code>-Confirm</code> / <code>-WhatIf</code></td><td>Standard PowerShell <code>ShouldProcess</code> switches. <code>remove</code>, <code>lock</code>, and <code>account-lock</code> prompt for confirmation by default (<code>ConfirmImpact = High</code>); pass <code>-Confirm:$false</code> to skip the prompt in scripts, or <code>-WhatIf</code> to preview without acting.</td></tr></tbody></table>

Identifiers that match more than one device are reported as ambiguous and skipped, unless `"all"` is specified.

**Examples**

{% code expandable="true" %}

```ps1
# remove device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action remove -User "user@company.com" -Devices "1"

```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command:** `device-admin-action remove`

**Parameters:**

* `enterprise_user_id` Enterprise user ID
* `device` Device ID from `device-admin-list` or exact device name

**Example:**

```bash
My Vault> device-admin-action remove 123456 1
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `remove_admin_user_devices`

**Parameters:**

* `keeper_auth_context` Logged-in `KeeperAuth` session
* `enterprise_user_id` Enterprise user ID
* `device_identifiers` One or more device list indexes from `device-admin-list`, or exact device names

**Example:**

```python
from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.remove_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' removed for user {enterprise_user_id}")
```

</details>

### Device Admin Lock

Locks a selected device for the target user.

<details>

<summary>DotNet CLI</summary>

**Command :** `device-admin-action lock <user> <devices> [--yes]`

**Parameters**

<table><thead><tr><th width="250">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>user</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>devices</code></td><td>Comma-separated device identifiers. Accepts: <code>id:&#x3C;prefix></code> (device ID prefix), <code>name:&#x3C;text></code> (device name substring), <code>#&#x3C;row></code> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or <code>"all"</code>.</td></tr><tr><td><code>--yes</code></td><td>Skips the confirmation prompt shown before <code>remove</code>, <code>lock</code>, and <code>account-lock</code>. Use for unattended/scripted runs.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
# lock a device by ID prefix, skipping confirmation
My Vault> device-admin-action lock user@company.com id:a1b2c3 --yes

My Vault> device-admin-action lock user@company.com "#1"
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command** : `Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]`

**Parameters**

<table><thead><tr><th width="236">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>-User</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>-Devices</code></td><td>Device ID(s), device name(s), <code>id:&#x3C;prefix></code>, <code>name:&#x3C;text></code>, <code>#&#x3C;row></code> (row number from <code>Get-KeeperAdminUserDevice</code> for this user), or <code>"all"</code>. Accepts a comma-separated string or an array of strings.</td></tr><tr><td><code>-Confirm</code> / <code>-WhatIf</code></td><td>Standard PowerShell <code>ShouldProcess</code> switches. <code>remove</code>, <code>lock</code>, and <code>account-lock</code> prompt for confirmation by default (<code>ConfirmImpact = High</code>); pass <code>-Confirm:$false</code> to skip the prompt in scripts, or <code>-WhatIf</code> to preview without acting.</td></tr></tbody></table>

Identifiers that match more than one device are reported as ambiguous and skipped, unless `"all"` is specified.

**Examples**

{% code expandable="true" %}

```ps1
# Lock device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action lock -User "user@company.com" -Devices "1"

```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command:** `device-admin-action lock`

**Parameters:**

* `enterprise_user_id` Enterprise user ID
* `device` Device ID from `device-admin-list` or exact device name

**Example:**

```bash
My Vault> device-admin-action lock 123456 1
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `lock_admin_user_devices`

**Parameters:**

* `keeper_auth_context` Logged-in `KeeperAuth` session
* `enterprise_user_id` Enterprise user ID
* `device_identifiers` One or more device list indexes from `device-admin-list`, or exact device names

**Example:**

```python
from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.lock_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' locked for user {enterprise_user_id}")
```

</details>

### Device Admin Unlock

Unlocks a selected device for the target user.

<details>

<summary>DotNet CLI</summary>

**Command :** `device-admin-action unlock <user> <devices> [--yes]`

**Parameters**

<table><thead><tr><th width="250">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>user</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>devices</code></td><td>Comma-separated device identifiers. Accepts: <code>id:&#x3C;prefix></code> (device ID prefix), <code>name:&#x3C;text></code> (device name substring), <code>#&#x3C;row></code> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or <code>"all"</code>.</td></tr><tr><td><code>--yes</code></td><td>Skips the confirmation prompt shown before <code>remove</code>, <code>lock</code>, and <code>account-lock</code>. Use for unattended/scripted runs.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
# unlock a device by ID prefix, skipping confirmation
My Vault> device-admin-action unlock user@company.com id:a1b2c3 --yes
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command** : `Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]`

**Parameters**

<table><thead><tr><th width="236">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>-User</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>-Devices</code></td><td>Device ID(s), device name(s), <code>id:&#x3C;prefix></code>, <code>name:&#x3C;text></code>, <code>#&#x3C;row></code> (row number from <code>Get-KeeperAdminUserDevice</code> for this user), or <code>"all"</code>. Accepts a comma-separated string or an array of strings.</td></tr><tr><td><code>-Confirm</code> / <code>-WhatIf</code></td><td>Standard PowerShell <code>ShouldProcess</code> switches. <code>remove</code>, <code>lock</code>, and <code>account-lock</code> prompt for confirmation by default (<code>ConfirmImpact = High</code>); pass <code>-Confirm:$false</code> to skip the prompt in scripts, or <code>-WhatIf</code> to preview without acting.</td></tr></tbody></table>

Identifiers that match more than one device are reported as ambiguous and skipped, unless `"all"` is specified.

**Examples**

{% code expandable="true" %}

```ps1
# Unlock device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action Unlock -User "user@company.com" -Devices "1"

```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command:** `device-admin-action unlock`

**Parameters:**

* `enterprise_user_id` Enterprise user ID
* `device` Device ID from `device-admin-list` or exact device name

**Example:**

```bash
My Vault> device-admin-action unlock 123456 1
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `unlock_admin_user_devices`

**Parameters:**

* `keeper_auth_context` Logged-in `KeeperAuth` session
* `enterprise_user_id` Enterprise user ID
* `device_identifiers` One or more device list indexes from `device-admin-list`, or exact device names

**Example:**

```python
from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.unlock_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' unlocked for user {enterprise_user_id}")
```

</details>

### Device Admin Account-lock

Account-locks a selected device for the target user.

<details>

<summary>DotNet CLI</summary>

**Command :** `device-admin-action account-lock <user> <devices> [--yes]`

**Parameters**

<table><thead><tr><th width="250">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>user</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>devices</code></td><td>Comma-separated device identifiers. Accepts: <code>id:&#x3C;prefix></code> (device ID prefix), <code>name:&#x3C;text></code> (device name substring), <code>#&#x3C;row></code> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or <code>"all"</code>.</td></tr><tr><td><code>--yes</code></td><td>Skips the confirmation prompt shown before <code>remove</code>, <code>lock</code>, and <code>account-lock</code>. Use for unattended/scripted runs.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
# Account lock to the device by ID prefix, skipping confirmation
My Vault> device-admin-action account-lock user@company.com id:a1b2c3 --yes
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command** : `Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]`

**Parameters**

<table><thead><tr><th width="236">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>-User</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>-Devices</code></td><td>Device ID(s), device name(s), <code>id:&#x3C;prefix></code>, <code>name:&#x3C;text></code>, <code>#&#x3C;row></code> (row number from <code>Get-KeeperAdminUserDevice</code> for this user), or <code>"all"</code>. Accepts a comma-separated string or an array of strings.</td></tr><tr><td><code>-Confirm</code> / <code>-WhatIf</code></td><td>Standard PowerShell <code>ShouldProcess</code> switches. <code>remove</code>, <code>lock</code>, and <code>account-lock</code> prompt for confirmation by default (<code>ConfirmImpact = High</code>); pass <code>-Confirm:$false</code> to skip the prompt in scripts, or <code>-WhatIf</code> to preview without acting.</td></tr></tbody></table>

Identifiers that match more than one device are reported as ambiguous and skipped, unless `"all"` is specified.

**Examples**

{% code expandable="true" %}

```ps1
# Account lock device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action account-lock -User "user@company.com" -Devices "1"

```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command:** `device-admin-action account-lock`

**Parameters:**

* `enterprise_user_id` Enterprise user ID
* `device` Device ID from `device-admin-list` or exact device name

**Example:**

```bash
My Vault> device-admin-action account-lock 123456 1
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `account_lock_admin_user_devices`

**Parameters:**

* `keeper_auth_context` Logged-in `KeeperAuth` session
* `enterprise_user_id` Enterprise user ID
* `device_identifiers` One or more device list indexes from `device-admin-list`, or exact device names

**Example:**

```python
from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.account_lock_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' account locked for user {enterprise_user_id}")
```

</details>

### Device Admin Account-unlock

Account-unlocks a selected device for the target user.

<details>

<summary>DotNet CLI</summary>

**Command :** `device-admin-action account-unlock <user> <devices> [--yes]`

**Parameters**

<table><thead><tr><th width="250">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>user</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>devices</code></td><td>Comma-separated device identifiers. Accepts: <code>id:&#x3C;prefix></code> (device ID prefix), <code>name:&#x3C;text></code> (device name substring), <code>#&#x3C;row></code> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or <code>"all"</code>.</td></tr><tr><td><code>--yes</code></td><td>Skips the confirmation prompt shown before <code>remove</code>, <code>lock</code>, and <code>account-lock</code>. Use for unattended/scripted runs.</td></tr></tbody></table>

**Examples**:

{% code expandable="true" %}

```csharp
# Account unlock to a device by ID prefix, skipping confirmation
My Vault> device-admin-action account-unlock user@company.com id:a1b2c3 --yes
```

{% endcode %}

</details>

<details>

<summary>DotNet SDK</summary>

Coming Soon

</details>

<details>

<summary>PowerCommander</summary>

**Command** : `Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]`

**Parameters**

<table><thead><tr><th width="236">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>-Action</code></td><td>One of: <code>logout</code>, <code>remove</code>, <code>lock</code>, <code>unlock</code>, <code>account-lock</code>, <code>account-unlock</code>.</td></tr><tr><td><code>-User</code></td><td>Enterprise user email or ID that owns the target device(s).</td></tr><tr><td><code>-Devices</code></td><td>Device ID(s), device name(s), <code>id:&#x3C;prefix></code>, <code>name:&#x3C;text></code>, <code>#&#x3C;row></code> (row number from <code>Get-KeeperAdminUserDevice</code> for this user), or <code>"all"</code>. Accepts a comma-separated string or an array of strings.</td></tr><tr><td><code>-Confirm</code> / <code>-WhatIf</code></td><td>Standard PowerShell <code>ShouldProcess</code> switches. <code>remove</code>, <code>lock</code>, and <code>account-lock</code> prompt for confirmation by default (<code>ConfirmImpact = High</code>); pass <code>-Confirm:$false</code> to skip the prompt in scripts, or <code>-WhatIf</code> to preview without acting.</td></tr></tbody></table>

Identifiers that match more than one device are reported as ambiguous and skipped, unless `"all"` is specified.

**Examples**

{% code expandable="true" %}

```ps1
# Account Unlock device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action account-unlock -User "user@company.com" -Devices "1"

```

{% endcode %}

</details>

<details>

<summary>Python CLI</summary>

**Command:** `device-admin-action account-unlock`

**Parameters:**

* `enterprise_user_id` Enterprise user ID
* `device` Device ID from `device-admin-list` or exact device name

**Example:**

```bash
My Vault> device-admin-action account-unlock 123456 1
```

</details>

<details>

<summary>Python SDK</summary>

**Function:** `account_unlock_admin_user_devices`

**Parameters:**

* `keeper_auth_context` Logged-in `KeeperAuth` session
* `enterprise_user_id` Enterprise user ID
* `device_identifiers` One or more device list indexes from `device-admin-list`, or exact device names

**Example:**

```python
from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.account_unlock_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' account unlocked for user {enterprise_user_id}")
```

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.keeper.io/keeperpam/commander-sdk/keeper-commander-sdks/sdk-command-reference/device-commands/device-admin-commands.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.