Deployment
Deploying the Keeper Agent to your endpoints
Deploying Endpoint Privilege Manager is very simple. The admin creates a custom deployment package associated to a collection of endpoints, and pushes the Keeper agent to those endpoints. When the agent starts up, it immediately registers itself with the Keeper tenant and starts collecting basic information about the endpoint, including the executables and local user accounts. By default, the Keeper agent goes into a "monitoring" mode, and no action is taken.
There are two main parts:
Create a deployment package in the Keeper Admin Console
Install and register the agent on endpoints
Once complete, the device can receive policies and report activity.
Core Deployment Workflow
All deployment methods follow the same steps:
Create deployment package
Install agent
Register endpoint
Assign to collections
Validate deployment
Requirements
macOS: Tahoe → Full Support (best experience) | Sonoma / Sequoia → Partial support
Linux: Ubuntu 22.04+
Windows: 11, Server 2022 and 2025 (Intel x64 Only)
Domain Controller Installation Not Supported
Keeper Endpoint Privilege Manager (EPM) cannot be installed on Windows Domain Controllers. The installer actively blocks installation on Domain Controllers and will display the error:
"This software cannot be installed on a Domain Controller."
Domain Controllers serve a specialized role in Active Directory environments and are not supported endpoints for the EPM agent. If you need to manage privilege policies across your domain, install the EPM agent on member workstations and servers rather than on the Domain Controller itself.
⚠️ Directory Integration Required
EPM policies targeting user and group collections depend on AD or Entra ID sync to function correctly. The epm scim command requires an Active Directory integration in the Keeper Admin Console before use. If this integration is not configured, collections will be incomplete and policy enforcement will not apply as expected.
Visit this page for more information.
Encryption
All communications between the Keeper Agent and the Keeper Admin Console are using end-to-end encryption with a zero knowledge architecture, which means that Keeper's servers and employees have no ability to decrypt any information about the endpoint. Only the Keeper Administrator who logs in to the Admin Console can decrypt the endpoint collections and associated metadata.
Deployment Package
From the Endpoint Privilege Manager > Deployments screen, select "New Deployment Package". The Keeper agent can be deployed to any Windows, macOS or Linux endpoint. The executable requires local admin privilege to install the agent. For automatic deployment through your remote management solution or group policy, push out the installer in silent mode using the provided command-line string.
Deployment Collections
When creating a deployment package, the assigned "Collection" name is referenced throughout the privilege manager when applying policies. The collection name typically refers to a group of users sharing a common platform or use case.
Agent Deployment
From the Admin Console UI, copy the installer zip file and download it to your machine. Unzip the file to extract the packages for each specific platform. Copy the deployment token for use in the installer command. A valid deployment token is required to register the Keeper Agent to your tenant.
Always verify the Keeper agent in your sandbox or non-production test environment before installing directly on production systems.
See the Command Line Policy documentation for configuration and usage instructions.
The Keeper Agent will launch for users upon a new login session. Therefore logout/login may be required.
The
sudopolicy controls are documented on the Command Line Policy page.Installation of packages (.pkg) and images (.dmg) requires that the user explicitly opens the request from the Keeper agent UI.
Discovery of Inventory Data
Inventory Collection Schedules
Basic (inventory-basic / InventoryBasic): runs every 7200 minutes (5 days); also runs on AgentRegistered and Startup User (user-inventory / UserInventory): runs every 7200 minutes (5 days); also runs on AgentRegistered and Startup Application (file-inventory / FileInventory): runs every 7200 minutes (5 days); also runs on Startup only (no AgentRegistered trigger)
Details
Schedule: All three use the same interval: intervalMinutes: 7200 (120 hours = 5 days). Basic and User also run on: AgentRegistered – when the agent registers with the backend Startup – when the agent starts Application (file inventory) runs on the same 5‑day interval and on Startup only; it does not have an AgentRegistered trigger. User, Application, and Basic all run on a 5‑day (7200‑minute) schedule; Basic and User additionally run on agent registration and startup.
When the agent is installed and deployed to the endpoints, there are 3 types of discovery that is performed on the endpoint:
Basic Inventory: Operating system, version, type
Account Inventory: Local users and groups
File Inventory: All executables on the system
The Keeper Admin Console will receive the discovered inventory as encrypted telemetry data, containing information about the endpoint including:
Computer name and type
OS information (Windows, macOS, Linux) and version
Local user account information
Local group account information
Installed applications
When deploying Keeper, we recommend installing the agent on reference machines in order to collect as much standardized inventory data as possible, before deploying to your fleet of devices.
The Deployment page displays the endpoint stats organized by collection.
The collection can be enabled or disabled from the dashboard. When a collection is disabled, the policy engine will no longer apply to those devices. Individual endpoints can also be disabled, to prevent the agent from applying policies.
Automation with Commander
Keeper Commander supports deployment automation through our command-line interface, Service Mode REST API and Python SDK. Learn more about Endpoint Privilege Manager commands.
Agent Management
The epm agent command provides management over individual agents running on the endpoint.
Deployment
The epm deployment command provides management over agent deployments.
Reports
The epm report command provides event logs and event reports.
Antivirus / EDR Exclusion Requirements
When deploying Keeper Endpoint Privilege Manager alongside third‑party antivirus or EDR solutions, the EPM installation directory should be excluded from real‑time scanning. This prevents performance degradation and avoids interference with policy evaluation, process interception, and privilege‑elevation workflows.
Required Exclusion Path
Product‑Specific Instructions
Microsoft Defender Run in elevated PowerShell:
CrowdStrike Falcon Falcon Console → Endpoint Security → Configure → Exclusions → Add folder path (include subfolders) SentinelOne Management Console → Sentinels → Exclusions → Add Path Exclusion Mode: Interoperability – Extended (include subfolders) Sophos Central Global Settings → Global Exclusions → Add Exclusion → File or Folder (Windows) Apply to real‑time and scheduled scanning
If you experience CallerCheck alerts on you endpoints, you can exclude them with the specific thumbprint of the event:
Global Settings → Global Exclusions → Add Exclusion → Detected Exploits (Windows/Mac) → <thumbprint> (same across machines but unique per Sophos account).
Symantec/Broadcom SEP
SEPM Console → Policies → Exceptions → Add Windows Exception → Folder (include subfolders)
Trend Micro Apex One
Apex Central or local console → Scan Exclusion List → Add directory
GPO Deployment (Microsoft Defender)
Add: C:\Program Files\Keeper Security\Endpoint Privilege Manager with a value of 0.
Last updated