MaintainKeeperAccount Configuration

The MaintainKeeperAccount setting controls whether the KeeperUserSession ephemeral administrator account persists between Keeper EPM service restarts. It exists primarily for Windows environments with specific identity management requirements — most commonly hybrid Azure AD (Microsoft Entra ID) + Intune deployments, and other environments where local account churn causes downstream issues.

By default the setting is disabled, and Keeper EPM deletes and recreates the KeeperUserSession account on every service restart. This is the correct behavior for most deployments. Enable the setting only when account churn is causing measurable problems.

For background on the account itself, see the KeeperUserSession Ephemeral Account reference.

Configuration

The setting lives in the Settings section of the Keeper EPM service's appsettings.json:

{
  "Settings": {
    "MaintainKeeperAccount": false
  }
}

Setting	Type	Default	Description
MaintainKeeperAccount	boolean	false	When true, the KeeperUserSession account persists across service restarts instead of being deleted and recreated.

Applies to: Windows. The setting has no effect on macOS or Linux.

Restart required: The setting is read at service startup and shutdown. Changes take effect on the next service restart cycle.

Preferred deployment method: Rather than editing appsettings.json directly on each endpoint, push the setting from a central SettingsUpdate policy. See Use a Policy to Set Settings for the policy-driven pattern.

When to Enable

Enable When

Hybrid Azure AD + Intune Environments

Azure AD Connect may sync local accounts on domain-joined or hybrid-joined endpoints. When Keeper EPM deletes and recreates KeeperUserSession on each service restart, Azure AD sees continuous account churn — creating and deleting the same account name with different SIDs each time. Symptoms include:

• Azure AD sync delays or backlog
• Intune policies that reference the KeeperUserSession SID losing their target on each restart
• Compliance alerts triggered by unexpected local-account activity

Active Directory Environments with Aggressive Sync

Any AD environment where account changes trigger downstream sync events, external process runs, or audit alerts benefits from a stable account rather than churn.

Performance-Sensitive Deployments

Account creation involves SAM database writes. On systems with slow SAM operations, or where minimizing service restart time is critical, persisting the account eliminates the create-on-start cost.

Keep Disabled (by Default) When

Standard deployments

Most Windows deployments — standalone workstations, domain-joined systems without Azure AD hybrid join, environments with no sync sensitivity — should leave this at the default. Fresh credentials on every restart is the cleaner security posture.

Maximum security requirements

Environments that require fresh credential material on every restart, or that treat any persistent local admin account as an audit finding, should keep the default.

Testing and development

A clean slate between restarts makes reproducing issues easier.

Behavior Comparison

Default: MaintainKeeperAccount = false

Event	Behavior
Service starts	Delete any existing KeeperUserSession account, then create a new one with a freshly generated password
Service stops	Delete the KeeperUserSession account
Service crashes	Orphaned account cleaned up on next startup
Profile folders	Orphaned C:\Users\KeeperUserSession.* folders cleaned up by the profile-folder cleanup job

Advantages: fresh credentials on each restart; no persistent local admin account when the service is stopped; cleaner security posture.

Enabled: MaintainKeeperAccount = true

Event	Behavior
Service starts	Reuse the existing KeeperUserSession account (password rotated)
Service stops	Keep the KeeperUserSession account
Service crashes	Account remains; reused on restart
Profile folders	Orphaned profile folders still cleaned up (though far fewer are generated)

Advantages: faster startup (no delete/create cycle); stable account SID for Azure AD sync and Intune policy targeting; no sync churn.

Security Considerations

The KeeperUserSession password is cryptographically generated, protected at rest via DPAPI on Windows, rotated on each service restart (or each elevation, when the account is persistent), and never exposed to end users or written to logs. See the KeeperUserSession Ephemeral Account page for full password-generation and handling details.

When MaintainKeeperAccount = true, additional considerations apply:

• Account persistence risk: A local administrator account remains on the endpoint when the Keeper EPM service is stopped. If the service is uninstalled without cleanup, the account may remain. Ensure your uninstall procedures include account removal.
• Auditing: Include KeeperUserSession in regular local-admin audits. Monitor for authentication attempts or process launches that were not initiated by Keeper EPM.
• Access restriction: Where possible, restrict the account via Group Policy — for example, deny interactive logon, deny network logon, deny logon through Remote Desktop Services. Keeper EPM only needs the account for local process elevation.

Orphaned Profile Folders

On Windows, deleting and recreating the KeeperUserSession account can leave behind profile folders under C:\Users, for example:

• C:\Users\KeeperUserSession
• C:\Users\KeeperUserSession.12-30-HOSTNAME
• C:\Users\KeeperUserSession.12-30-HOSTNAME.000, .001, .002, and so on

These are cosmetic — they don't affect Keeper EPM functionality — but they can accumulate on the disk over time, especially on endpoints that restart the service frequently.

Keeper EPM automatically cleans them up via the ephemeral-orphan-profile-folders-cleanup scheduled job, which runs every 5 minutes. The job deletes any folder under C:\Users whose name is exactly KeeperUserSession or begins with KeeperUserSession., and removes the matching ProfileList registry entries under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.

Enabling MaintainKeeperAccount = true largely eliminates the churn that causes these folders to accumulate in the first place.

Troubleshooting

Account is Deleted Despite MaintainKeeperAccount Being True

Diagnosis: Check the Keeper EPM service logs at startup. When the setting is correctly enabled, you will see:

MaintainKeeperAccount is enabled - skipping account deletion on startup (account will be reused)

If instead you see:

Starting KeeperUserSession ephemeral account cleanup
KeeperUserSession deleted or did not exist

then the setting is being read as false.

Resolution:

1. Confirm the setting is in the Settings section of appsettings.json, not another section
2. Confirm the JSON is syntactically valid (a syntax error causes the file to fail to load and all settings to fall back to defaults)
3. Restart the Keeper EPM service and re-check the logs
4. If you push settings via a SettingsUpdate policy, confirm the policy has run and the merge succeeded

Azure AD Reports Frequent Account Additions/Deletions

Cause: Keeper EPM is deleting and recreating KeeperUserSession on each service restart, and Azure AD Connect is syncing each event.

Resolution:

1. Enable MaintainKeeperAccount = true
2. Confirm Azure AD Connect sync scope doesn't include the KeeperUserSession account (either by scope filter or by excluding it explicitly)
3. Consider excluding local system accounts from sync where organizational policy allows

Orphaned KeeperUserSession Folders Accumulating in C:\Users

Cause: Either the cleanup job is not running, or new folders are being created faster than cleanup can remove them.

Resolution:

1. Verify the Keeper EPM service is running as SYSTEM and has permission to modify C:\Users
2. Verify the ephemeral-orphan-profile-folders-cleanup job is enabled and scheduled
3. If churn is the underlying cause, enable MaintainKeeperAccount = true
4. For manual cleanup:

# Run as administrator
Get-ChildItem "C:\Users" -Filter "KeeperUserSession*" -Directory | Remove-Item -Recurse -Force

Also remove the matching entries under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList if any remain.

Recommendations

1. Assess your environment first. Before enabling, confirm you are actually experiencing Azure AD sync churn, Intune SID targeting failures, or measurable startup delays. Don't enable prophylactically.
2. Document which endpoints have it enabled and why. Useful for security audits, troubleshooting, and compliance reporting.
3. Test in staging. Enable on a non-production endpoint first, verify the Azure AD or Intune symptoms improve, and confirm security monitoring still captures account activity as expected.
4. Include KeeperUserSession in regular security audits whenever the account is persistent.
5. Deploy via SettingsUpdate policy rather than manual appsettings.json edits, to keep configuration centralized and reproducible.