Device Admin Commands

Admin commands for managing devices across enterprise users

Overview

These commands let enterprise administrators view and manage devices for users they control.

Enterprise device commands require administrator privileges.

• Device Admin List

• Device Admin Logout

• Device Admin Remove

• Device Admin Lock

• Device Admin Unlock

• Device Admin Account-lock

• Device Admin Account-unlock

Device Admin List

Lists devices for one or more enterprise users.

DotNet CLI

Command : device-admin-list [user] [--format <table|json>]

Parameters

Parameter	Description
user	Enterprise user email, user ID, or "all". If omitted, lists devices for every enterprise user.
--format	Output format: table (default) or json.

Examples

# List devices for a single enterprise user
My vault> device-admin-list [e-mail]

# List devices for every enterprise user
My vault> device-admin-list all

# List devices for a user as JSON
My vault> device-admin-list [e-mail] --format json

DotNet SDK

Coming Soon

PowerCommander

Command : Get-KeeperAdminUserDevice [[-User] <String>] [-Format <String>]

Parameters

Parameter	Description
-User	Enterprise user email or ID. If omitted (or "all"), lists devices for every enterprise user.
-Format	table (default) or json.

Examples:

# List devices for a single enterprise user
PS > Get-KeeperAdminUserDevice -User "[e-mail]"

# List devices for every enterprise user
PS > Get-KeeperAdminUserDevice

# List devices for a user as JSON
PS > Get-KeeperAdminUserDevice -User "[e-mail]" -Format json

Python CLI

Command: device-admin-list

Parameters:

• enterprise_user_ids One or more enterprise user IDs

• --format Output format. Values: table or json. Default: table

• --output Output file name. Ignored for table format

Example:

My Vault> device-admin-list 123456 789012
Admin Device List (5 devices found)
ID  Enterprise User ID  Device Name     UI Category        Device Status  Login Status  Last Accessed
1   123456              iPhone 12       iOS App            OK             LOGGED_IN     2025-01-15 10:30:25
2   123456              Chrome Browser  Browser Extension  OK             LOGGED_IN     2025-01-15 09:15:42
3   789012              Android Phone   Android App        OK             LOGGED_OUT    2025-01-14 18:22:15
4   789012              Work Desktop    Desktop            OK             LOGGED_IN     2025-01-15 08:45:33
5   789012              Web Browser     Web Vault          OK             LOGGED_IN     2025-01-15 11:22:18

Python SDK

Function: list_admin_devices

Parameters:

• keeper_auth_context Logged-in KeeperAuth session

• enterprise_user_ids One or more enterprise user IDs

Example:

from keepersdk.authentication import device_management

enterprise_user_ids = [37585258XXXX, 37585258XXXX]

devices = device_management.list_admin_devices(keeper_auth_context, enterprise_user_ids)

for d in devices:
    print(
        d.list_index,
        d.enterprise_user_id,
        d.name,
        d.ui_category,
        d.device_status,
        d.login_status,
        d.last_accessed,
    )

Device Admin Logout

Log out a user from selected device.

DotNet CLI

Command : device-admin-action logout <user> <devices> [--yes]

Parameters

Parameter	Description
action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
user	Enterprise user email or ID that owns the target device(s).
devices	Comma-separated device identifiers. Accepts: id:<prefix> (device ID prefix), name:<text> (device name substring), #<row> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or "all".
--yes	Skips the confirmation prompt shown before remove, lock, and account-lock. Use for unattended/scripted runs.

Examples:

# Logout a device by ID prefix, skipping confirmation
My Vault> device-admin-action logout [e-mail] id:a1b2c3 --yes

# Log out two devices by row number (non-destructive action, no prompt)
My Vault> device-admin-action logout [e-mail] "#1,#3"

DotNet SDK

Coming Soon

PowerCommander

Command : Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]

Parameters

Parameter	Description
-Action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
-User	Enterprise user email or ID that owns the target device(s).
-Devices	Device ID(s), device name(s), id:<prefix>, name:<text>, #<row> (row number from Get-KeeperAdminUserDevice for this user), or "all". Accepts a comma-separated string or an array of strings.
-Confirm / -WhatIf	Standard PowerShell ShouldProcess switches. remove, lock, and account-lock prompt for confirmation by default (ConfirmImpact = High); pass -Confirm:$false to skip the prompt in scripts, or -WhatIf to preview without acting.

Identifiers that match more than one device are reported as ambiguous and skipped, unless "all" is specified.

Examples

# Logout device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action logout -User "[e-mail]" -Devices "1"

Python CLI

Command: device-admin-action logout

Parameters:

• enterprise_user_id Enterprise user ID

• device Device ID from device-admin-list or exact device name

Example:

My Vault> device-admin-action logout 123456 1
✓ Device action successfully completed: 'iPhone 12' logged out for user 123456

Python SDK

Function: logout_admin_user_devices

Parameters:

• keeper_auth_context Logged-in KeeperAuth session

• enterprise_user_id Enterprise user ID

• device_identifiers One or more device IDs or exact device names

Example:

from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXXX
device_identifiers = ['1']  # or ['My Commander CLI']

names = device_management.logout_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)
for name in names:
    print(f"Device '{name}' logged out for user {enterprise_user_id}")

Device Admin Remove

Removes a selected device from a user account.

DotNet CLI

Command : device-admin-action remove <user> <devices> [--yes]

Parameters

Parameter	Description
action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
user	Enterprise user email or ID that owns the target device(s).
devices	Comma-separated device identifiers. Accepts: id:<prefix> (device ID prefix), name:<text> (device name substring), #<row> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or "all".
--yes	Skips the confirmation prompt shown before remove, lock, and account-lock. Use for unattended/scripted runs.

Examples

# removeadevice by ID prefix, skipping confirmation
My Vault> device-admin-action remove [e-mail] id:a1b2c3 --yes

DotNet SDK

Coming Soon

PowerCommander

Command : Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]

Parameters

Parameter	Description
-Action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
-User	Enterprise user email or ID that owns the target device(s).
-Devices	Device ID(s), device name(s), id:<prefix>, name:<text>, #<row> (row number from Get-KeeperAdminUserDevice for this user), or "all". Accepts a comma-separated string or an array of strings.
-Confirm / -WhatIf	Standard PowerShell ShouldProcess switches. remove, lock, and account-lock prompt for confirmation by default (ConfirmImpact = High); pass -Confirm:$false to skip the prompt in scripts, or -WhatIf to preview without acting.

Identifiers that match more than one device are reported as ambiguous and skipped, unless "all" is specified.

Examples

# remove device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action remove -User "[e-mail]" -Devices "1"

Python CLI

Command: device-admin-action remove

Parameters:

• enterprise_user_id Enterprise user ID

• device Device ID from device-admin-list or exact device name

Example:

My Vault> device-admin-action remove 123456 1

Python SDK

Function: remove_admin_user_devices

Parameters:

• keeper_auth_context Logged-in KeeperAuth session

• enterprise_user_id Enterprise user ID

• device_identifiers One or more device list indexes from device-admin-list, or exact device names

Example:

from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.remove_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' removed for user {enterprise_user_id}")

Device Admin Lock

Locks a selected device for the target user.

DotNet CLI

Command : device-admin-action lock <user> <devices> [--yes]

Parameters

Parameter	Description
action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
user	Enterprise user email or ID that owns the target device(s).
devices	Comma-separated device identifiers. Accepts: id:<prefix> (device ID prefix), name:<text> (device name substring), #<row> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or "all".
--yes	Skips the confirmation prompt shown before remove, lock, and account-lock. Use for unattended/scripted runs.

Examples:

# lock a device by ID prefix, skipping confirmation
My Vault> device-admin-action lock [e-mail] id:a1b2c3 --yes

My Vault> device-admin-action lock [e-mail] "#1"

DotNet SDK

Coming Soon

PowerCommander

Command : Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]

Parameters

Parameter	Description
-Action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
-User	Enterprise user email or ID that owns the target device(s).
-Devices	Device ID(s), device name(s), id:<prefix>, name:<text>, #<row> (row number from Get-KeeperAdminUserDevice for this user), or "all". Accepts a comma-separated string or an array of strings.
-Confirm / -WhatIf	Standard PowerShell ShouldProcess switches. remove, lock, and account-lock prompt for confirmation by default (ConfirmImpact = High); pass -Confirm:$false to skip the prompt in scripts, or -WhatIf to preview without acting.

Identifiers that match more than one device are reported as ambiguous and skipped, unless "all" is specified.

Examples

# Lock device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action lock -User "[e-mail]" -Devices "1"

Python CLI

Command: device-admin-action lock

Parameters:

• enterprise_user_id Enterprise user ID

• device Device ID from device-admin-list or exact device name

Example:

My Vault> device-admin-action lock 123456 1

Python SDK

Function: lock_admin_user_devices

Parameters:

• keeper_auth_context Logged-in KeeperAuth session

• enterprise_user_id Enterprise user ID

• device_identifiers One or more device list indexes from device-admin-list, or exact device names

Example:

from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.lock_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' locked for user {enterprise_user_id}")

Device Admin Unlock

Unlocks a selected device for the target user.

DotNet CLI

Command : device-admin-action unlock <user> <devices> [--yes]

Parameters

Parameter	Description
action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
user	Enterprise user email or ID that owns the target device(s).
devices	Comma-separated device identifiers. Accepts: id:<prefix> (device ID prefix), name:<text> (device name substring), #<row> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or "all".
--yes	Skips the confirmation prompt shown before remove, lock, and account-lock. Use for unattended/scripted runs.

Examples:

# unlock a device by ID prefix, skipping confirmation
My Vault> device-admin-action unlock [e-mail] id:a1b2c3 --yes

DotNet SDK

Coming Soon

PowerCommander

Command : Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]

Parameters

Parameter	Description
-Action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
-User	Enterprise user email or ID that owns the target device(s).
-Devices	Device ID(s), device name(s), id:<prefix>, name:<text>, #<row> (row number from Get-KeeperAdminUserDevice for this user), or "all". Accepts a comma-separated string or an array of strings.
-Confirm / -WhatIf	Standard PowerShell ShouldProcess switches. remove, lock, and account-lock prompt for confirmation by default (ConfirmImpact = High); pass -Confirm:$false to skip the prompt in scripts, or -WhatIf to preview without acting.

Identifiers that match more than one device are reported as ambiguous and skipped, unless "all" is specified.

Examples

# Unlock device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action Unlock -User "[e-mail]" -Devices "1"

Python CLI

Command: device-admin-action unlock

Parameters:

• enterprise_user_id Enterprise user ID

• device Device ID from device-admin-list or exact device name

Example:

My Vault> device-admin-action unlock 123456 1

Python SDK

Function: unlock_admin_user_devices

Parameters:

• keeper_auth_context Logged-in KeeperAuth session

• enterprise_user_id Enterprise user ID

• device_identifiers One or more device list indexes from device-admin-list, or exact device names

Example:

from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.unlock_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' unlocked for user {enterprise_user_id}")

Device Admin Account-lock

Account-locks a selected device for the target user.

DotNet CLI

Command : device-admin-action account-lock <user> <devices> [--yes]

Parameters

Parameter	Description
action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
user	Enterprise user email or ID that owns the target device(s).
devices	Comma-separated device identifiers. Accepts: id:<prefix> (device ID prefix), name:<text> (device name substring), #<row> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or "all".
--yes	Skips the confirmation prompt shown before remove, lock, and account-lock. Use for unattended/scripted runs.

Examples:

# Account lock to the device by ID prefix, skipping confirmation
My Vault> device-admin-action account-lock [e-mail] id:a1b2c3 --yes

DotNet SDK

Coming Soon

PowerCommander

Command : Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]

Parameters

Parameter	Description
-Action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
-User	Enterprise user email or ID that owns the target device(s).
-Devices	Device ID(s), device name(s), id:<prefix>, name:<text>, #<row> (row number from Get-KeeperAdminUserDevice for this user), or "all". Accepts a comma-separated string or an array of strings.
-Confirm / -WhatIf	Standard PowerShell ShouldProcess switches. remove, lock, and account-lock prompt for confirmation by default (ConfirmImpact = High); pass -Confirm:$false to skip the prompt in scripts, or -WhatIf to preview without acting.

Identifiers that match more than one device are reported as ambiguous and skipped, unless "all" is specified.

Examples

# Account lock device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action account-lock -User "[e-mail]" -Devices "1"

Python CLI

Command: device-admin-action account-lock

Parameters:

• enterprise_user_id Enterprise user ID

• device Device ID from device-admin-list or exact device name

Example:

My Vault> device-admin-action account-lock 123456 1

Python SDK

Function: account_lock_admin_user_devices

Parameters:

• keeper_auth_context Logged-in KeeperAuth session

• enterprise_user_id Enterprise user ID

• device_identifiers One or more device list indexes from device-admin-list, or exact device names

Example:

from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.account_lock_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' account locked for user {enterprise_user_id}")

Device Admin Account-unlock

Account-unlocks a selected device for the target user.

DotNet CLI

Command : device-admin-action account-unlock <user> <devices> [--yes]

Parameters

Parameter	Description
action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
user	Enterprise user email or ID that owns the target device(s).
devices	Comma-separated device identifiers. Accepts: id:<prefix> (device ID prefix), name:<text> (device name substring), #<row> (1-based row number, resolved against this user's device list only), a bare value (tried as row number, then ID prefix, then name), or "all".
--yes	Skips the confirmation prompt shown before remove, lock, and account-lock. Use for unattended/scripted runs.

Examples:

# Account unlock to a device by ID prefix, skipping confirmation
My Vault> device-admin-action account-unlock [e-mail] id:a1b2c3 --yes

DotNet SDK

Coming Soon

PowerCommander

Command : Invoke-KeeperAdminUserDeviceAction [-Action] [-User] [-Devices] <String[]> [-Confirm] [-WhatIf]

Parameters

Parameter	Description
-Action	One of: logout, remove, lock, unlock, account-lock, account-unlock.
-User	Enterprise user email or ID that owns the target device(s).
-Devices	Device ID(s), device name(s), id:<prefix>, name:<text>, #<row> (row number from Get-KeeperAdminUserDevice for this user), or "all". Accepts a comma-separated string or an array of strings.
-Confirm / -WhatIf	Standard PowerShell ShouldProcess switches. remove, lock, and account-lock prompt for confirmation by default (ConfirmImpact = High); pass -Confirm:$false to skip the prompt in scripts, or -WhatIf to preview without acting.

Identifiers that match more than one device are reported as ambiguous and skipped, unless "all" is specified.

Examples

# Account Unlock device for a user (prompts for confirmation)
PS > Invoke-KeeperAdminUserDeviceAction -Action account-unlock -User "[e-mail]" -Devices "1"

Python CLI

Command: device-admin-action account-unlock

Parameters:

• enterprise_user_id Enterprise user ID

• device Device ID from device-admin-list or exact device name

Example:

My Vault> device-admin-action account-unlock 123456 1

Python SDK

Function: account_unlock_admin_user_devices

Parameters:

• keeper_auth_context Logged-in KeeperAuth session

• enterprise_user_id Enterprise user ID

• device_identifiers One or more device list indexes from device-admin-list, or exact device names

Example:

from keepersdk.authentication import device_management

enterprise_user_id = 37585258XXXX
device_identifiers = ['1']  # list index from device-admin-list, or device name

names = device_management.account_unlock_admin_user_devices(
    keeper_auth_context,
    enterprise_user_id,
    device_identifiers,
)

for name in names:
    print(f"Device '{name}' account unlocked for user {enterprise_user_id}")