Deployment
Deploying the Keeper Agent to your endpoints
Overview
Deploying Endpoint Privilege Manager is very simple. The admin creates a custom deployment package associated to a collection of endpoints, and pushes the Keeper agent to those endpoints. When the agent starts up, it immediately registers itself with the Keeper tenant and starts collecting basic information about the endpoint, including the executables and local user accounts. By default, the Keeper agent goes into a "monitoring" mode, and no action is taken.
There are two main parts:
Create a deployment package in the Keeper Admin Console
Install and register the agent on endpoints
Once complete, the device can receive policies and report activity.
The Core Deployment Workflow
All deployment methods follow the same steps:
Create deployment package
Install agent
Register endpoint
Assign to collections
Validate deployment
Requirements
macOS: Sequoia, Sonoma
Linux: Ubuntu 22.04+
Windows: 11, Server 2022 and 2025 (Intel x64 Only)
Domain Controller Installation Not Supported
Keeper Endpoint Privilege Manager (EPM) cannot be installed on Windows Domain Controllers. The installer actively blocks installation on Domain Controllers and will display the error:
"This software cannot be installed on a Domain Controller."
Domain Controllers serve a specialized role in Active Directory environments and are not supported endpoints for the EPM agent. If you need to manage privilege policies across your domain, install the EPM agent on member workstations and servers rather than on the Domain Controller itself.
⚠️ Directory Integration Required
EPM policies targeting user and group collections depend on AD or Entra ID sync to function correctly. The epm scim command requires an Active Directory integration in the Keeper Admin Console before use. If this integration is not configured, collections will be incomplete and policy enforcement will not apply as expected.
Visit this page for more information.
Encryption
All communications between the Keeper Agent and the Keeper Admin Console are using end-to-end encryption with a zero knowledge architecture, which means that Keeper's servers and employees have no ability to decrypt any information about the endpoint. Only the Keeper Administrator who logs in to the Admin Console can decrypt the endpoint collections and associated metadata.
Deployment Package
From the Endpoint Privilege Manager > Deployments screen, select "New Deployment Package". The Keeper agent can be deployed to any Windows, macOS or Linux endpoint. The executable requires local admin privilege to install the agent. For automatic deployment through your remote management solution or group policy, push out the installer in silent mode using the provided command-line string.
Deployment Collections
When creating a deployment package, the assigned "Collection" name is referenced throughout the privilege manager when applying policies. The collection name typically refers to a group of users sharing a common platform or use case.
Agent Deployment
From the Admin Console UI, copy the installer zip file and download it to your machine. Unzip the file to extract the packages for each specific platform. Copy the deployment token for use in the installer command. A valid deployment token is required to register the Keeper Agent to your tenant.
Always verify the Keeper agent in your sandbox or non-production test environment before installing directly on production systems.
See the Command Line Policy documentation for configuration and usage instructions.
The Keeper Agent will launch for users upon a new login session. Therefore logout/login may be required.
The
sudopolicy controls are documented on the Command Line Policy page.Installation of packages (.pkg) and images (.dmg) requires that the user explicitly opens the request from the Keeper agent UI.
Discovery of Inventory Data
Inventory Collection Schedules
Basic (inventory-basic / InventoryBasic): runs every 7200 minutes (5 days); also runs on AgentRegistered and Startup User (user-inventory / UserInventory): runs every 7200 minutes (5 days); also runs on AgentRegistered and Startup Application (file-inventory / FileInventory): runs every 7200 minutes (5 days); also runs on Startup only (no AgentRegistered trigger)
Details
Schedule: All three use the same interval: intervalMinutes: 7200 (120 hours = 5 days). Basic and User also run on: AgentRegistered – when the agent registers with the backend Startup – when the agent starts Application (file inventory) runs on the same 5‑day interval and on Startup only; it does not have an AgentRegistered trigger. User, Application, and Basic all run on a 5‑day (7200‑minute) schedule; Basic and User additionally run on agent registration and startup.
When the agent is installed and deployed to the endpoints, there are 3 types of discovery that is performed on the endpoint:
Basic Inventory: Operating system, version, type
Account Inventory: Local users and groups
File Inventory: All executables on the system
The Keeper Admin Console will receive the discovered inventory as encrypted telemetry data, containing information about the endpoint including:
Computer name and type
OS information (Windows, macOS, Linux) and version
Local user account information
Local group account information
Installed applications
When deploying Keeper, we recommend installing the agent on reference machines in order to collect as much standardized inventory data as possible, before deploying to your fleet of devices.
The Deployment page displays the endpoint stats organized by collection.
The collection can be enabled or disabled from the dashboard. When a collection is disabled, the policy engine will no longer apply to those devices.
Individual endpoints can also be disabled, to prevent the agent from applying policies.
Automation with Commander
Keeper Commander supports deployment automation through our command-line interface, Service Mode REST API and Python SDK. Learn more about Endpoint Privilege Manager commands.
Agent Management
The epm agent command provides management over individual agents running on the endpoint.
Deployment
The epm deployment command provides management over agent deployments.
Reports
The epm report command provides event logs and event reports.
Antivirus / EDR Exclusion Requirements
When deploying Keeper Endpoint Privilege Manager alongside third‑party antivirus or EDR solutions, the EPM installation directory should be excluded from real‑time scanning. This prevents performance degradation and avoids interference with policy evaluation, process interception, and privilege‑elevation workflows.
Required Exclusion Path
Product‑Specific Instructions
Microsoft Defender Run in elevated PowerShell:
CrowdStrike Falcon Falcon Console → Endpoint Security → Configure → Exclusions → Add folder path (include subfolders) SentinelOne Management Console → Sentinels → Exclusions → Add Path Exclusion Mode: Interoperability – Extended (include subfolders) Sophos Central Global Settings → Global Exclusions → Add Exclusion → File or Folder (Windows) Apply to real‑time and scheduled scanning
If you experience CallerCheck alerts on you endpoints, you can exclude them with the specific thumbprint of the event:
Global Settings → Global Exclusions → Add Exclusion → Detected Exploits (Windows/Mac) → <thumbprint> (same across machines but unique per Sophos account).
Symantec/Broadcom SEP
SEPM Console → Policies → Exceptions → Add Windows Exception → Folder (include subfolders)
Trend Micro Apex One
Apex Central or local console → Scan Exclusion List → Add directory
GPO Deployment (Microsoft Defender)
Add: C:\Program Files\Keeper Security\Endpoint Privilege Manager with a value of 0.
Suggested Deployment Phases
Successfully deploying Privileged Elevation and Delegation Management (PEDM) requires a phased approach that balances security with operational continuity. This guide outlines the recommended strategy for implementing Keeper's Endpoint Privilege Manager across your organization.
Phase 1: Validate in a Production-Like Test Environment
Before rolling KEPM out broadly, deploy it to a small set of test machines that closely match your production endpoints (same OS versions, device types, security baselines, and installed applications). Use this pilot to confirm that KEPM installs cleanly, policy enforcement behaves as expected, and there are no conflicts with existing security or management tools (such as EDR/XDR agents, antivirus, application control, DLP, VPN clients, or device management utilities).
In many environments, successful rollout requires creating exclusions/allowlists in other security tools so KEPM components can operate normally (for example, folder/process/network or script execution exclusions). Identify and document any required exclusions during this phase, then standardize and deploy them through your existing security management platform before expanding KEPM to additional endpoints.
Phase 2: Foundation and Discovery
Start with Monitor Mode
Begin your deployment by setting all policies to Monitor mode. This allows you to understand baseline privilege usage without disrupting user workflows.
Deploy the Keeper agent to a pilot group of endpoints (10-20% of your environment)
Set all initial policies to "Monitor" mode to observe privilege elevation patterns
Allow 1-2 weeks for comprehensive data collection
Focus on diverse endpoint types: developer workstations, standard user machines, and servers
Analyze Privilege Usage Patterns
During the monitoring phase, examine the dashboard for:
Frequent elevation requests: Applications and processes that regularly require admin privileges
User behavior patterns: Which users need elevated access and when
Legitimate business processes: Operations that require admin rights for valid reasons
Anomalous activity: Unusual privilege requests that may indicate security risks
Establish Collections and Organizational Structure
Create meaningful collections based on your findings:
User Groups: Organize by role (Developers, IT Staff, Standard Users, Executives)
Machine Collections: Group by function (Development Workstations, Servers, Kiosks)
Application Collections: Categorize business-critical vs. administrative tools
Custom Collections: Create specific groups for unique organizational needs
Phase 3: Gradual Policy Implementation
Begin with Monitor & Notify
Transition key policies from Monitor to Monitor & Notify mode:
Start with less critical applications and user groups
Focus on policies that showed consistent patterns during monitoring
Allow users to adapt to notifications before enforcement begins
Communicate changes to affected users in advance
Implement Basic Controls
Introduce foundational security measures with minimal user friction:
Justification Requirements: Start with simple justification policies for standard elevation requests
Time-based Restrictions: Apply stricter policies outside business hours
Application-specific Policies: Control access to high-risk or unnecessary administrative tools
Test Approval Workflows
For sensitive operations, implement approval-based policies:
Begin with a small group of trusted approvers
Test approval workflows with non-critical applications first
Establish clear escalation procedures and timeframes
Ensure 24/7 coverage for business-critical approvals
Phase 4: Enforcement and Least Privilege
Implement Least Privilege Gradually
Deploy the core least privilege model in phases:
Pilot Group: Start with 10-20 volunteer users from IT or security teams
Low-Risk Users: Expand to users with minimal admin needs
Standard Users: Remove local admin rights from general workforce
Power Users: Work with developers and IT staff to refine their specific needs
Deploy MFA Requirements
Add multi-factor authentication for sensitive operations:
Prioritize MFA for high-risk applications and system modifications
Ensure users are enrolled in Keeper vaults with appropriate 2FA methods
Provide clear setup instructions and support resources
Test MFA workflows during off-hours and emergency scenarios
Establish Advanced Policy Controls
Implement sophisticated policy combinations:
Layered Policies: Apply multiple policies to the same resources for defense-in-depth
Conditional Access: Use date/time windows for varying security levels
Application-specific Controls: Fine-tune policies based on application behavior
File Access Controls: Protect sensitive executables and system files
Phase 5: Optimization and Full Deployment
Scale to Full Environment
Expand to your complete endpoint fleet:
Deploy in batches of 100-200 endpoints per week
Monitor system performance and user feedback
Adjust policies based on operational requirements
Maintain emergency bypass procedures for critical situations
Continuous Monitoring and Refinement
Establish ongoing operational practices:
Weekly Reviews: Analyze elevation requests and policy effectiveness
Monthly Assessments: Review and adjust policies based on business changes
Quarterly Audits: Comprehensive evaluation of privilege management effectiveness
Annual Policy Reviews: Update policies to reflect organizational changes
Key Success Factors
Communication and Training
Provide clear documentation on new processes and expectations
Offer training sessions for end users on the new privilege model
Establish help desk procedures for privilege-related issues
Create self-service resources for common elevation requests
Technical Considerations
Ensure network connectivity for agent communication
Plan for offline policy evaluation capabilities
Implement proper logging and alerting for security events
Establish backup procedures for critical system access
Policy Design Best Practices
Start Restrictive: Apply the most restrictive policy when multiple policies conflict
Granular Controls: Use specific application and user targeting rather than broad policies
Business Alignment: Align policies with actual business processes and risk tolerance
Regular Updates: Keep policies current with changing business needs and threat landscape
Emergency Procedures
Maintain emergency break-glass procedures for critical system access
Document escalation paths for urgent privilege requests
Establish clear criteria for temporary policy suspension
Ensure 24/7 contact information for emergency approvals
Common Pitfalls to Avoid
Rushing Implementation: Take time to understand usage patterns before enforcing policies
Over-Engineering: Start simple and add complexity gradually
Insufficient Communication: Keep users informed throughout the deployment process
Ignoring Business Impact: Consider operational requirements when designing policies
Lack of Monitoring: Continuously monitor and adjust based on real-world usage
Measuring Success
Track these key metrics to evaluate deployment effectiveness:
Reduction in Standing Admin Rights: Percentage of users removed from local admin groups
Policy Compliance: Adherence to established privilege management policies
User Satisfaction: Feedback on process efficiency and user experience
Security Incidents: Reduction in privilege-related security events
Operational Efficiency: Time to resolution for legitimate privilege requests
By following this phased approach, organizations can successfully deploy Endpoint Privilege Manager while maintaining operational continuity and user satisfaction. The key is to move gradually, monitor continuously, and adjust based on real-world usage patterns and feedback.
Last updated