# Policy: Path Variables & Protected Paths

<figure><img src="/files/N5sIhB4ZUnHrwAwnjAYd" alt=""><figcaption></figcaption></figure>

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Variable</th><th>Windows example</th><th>Linux example</th><th>macOS example</th><th>Description</th></tr></thead><tbody><tr><td><code>{rootdir}</code></td><td><code>C:\</code></td><td><code>/</code></td><td><code>/</code></td><td>Drive or filesystem root</td></tr><tr><td><code>{documents}</code></td><td><code>C:\Users\&#x3C;user>\Documents</code></td><td><code>/home/&#x3C;user>/Documents</code></td><td><code>/Users/&#x3C;user>/Documents</code></td><td>User documents folder</td></tr><tr><td><code>{userdocuments}</code></td><td>Same as <code>{documents}</code></td><td>Same as <code>{documents}</code></td><td>Same as <code>{documents}</code></td><td>Alias for documents</td></tr><tr><td><code>{userdesktop}</code></td><td><code>C:\Users\&#x3C;user>\Desktop</code></td><td><code>/home/&#x3C;user>/Desktop</code></td><td><code>/Users/&#x3C;user>/Desktop</code></td><td>User desktop</td></tr><tr><td><code>{hasdesktop}</code></td><td><code>"true"</code> / <code>"false"</code></td><td><code>"true"</code> / <code>"false"</code></td><td><code>"true"</code> / <code>"false"</code></td><td>Whether a desktop environment is present</td></tr></tbody></table>

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="179.6666259765625">Variable</th><th>Typical value</th><th>Description</th></tr></thead><tbody><tr><td><code>{systemroot}</code></td><td><code>C:\Windows</code></td><td>Windows directory</td></tr><tr><td><code>{windows}</code></td><td><code>C:\Windows</code></td><td>Alias for systemroot</td></tr><tr><td><code>{systemdrive}</code></td><td><code>C:</code></td><td>System drive (no trailing backslash)</td></tr><tr><td><code>{system32}</code></td><td><code>C:\Windows\System32</code></td><td>System32 directory</td></tr><tr><td><code>{syswow64}</code></td><td><code>C:\Windows\SysWOW64</code></td><td>32-bit system on 64-bit Windows</td></tr><tr><td><code>{programfiles}</code></td><td><code>C:\Program Files</code></td><td>Program Files</td></tr><tr><td><code>{programfilesx86}</code></td><td><code>C:\Program Files (x86)</code></td><td>Program Files (x86)</td></tr><tr><td><code>{userprofile}</code></td><td><code>C:\Users\&#x3C;user></code></td><td>User profile directory</td></tr><tr><td><code>{appdata}</code></td><td><code>C:\Users\&#x3C;user>\AppData\Roaming</code></td><td>Roaming AppData</td></tr><tr><td><code>{localappdata}</code></td><td><code>C:\Users\&#x3C;user>\AppData\Local</code></td><td>Local AppData</td></tr><tr><td><code>{programdata}</code></td><td><code>C:\ProgramData</code></td><td>ProgramData</td></tr><tr><td><code>{temp}</code></td><td><code>C:\Users\&#x3C;user>\AppData\Local\Temp</code></td><td>User temp directory</td></tr></tbody></table>

| Variable          | Example                   | Description           |
| ----------------- | ------------------------- | --------------------- |
| `{system}`        | `/System`                 | System root           |
| `{library}`       | `/Library`                | Library               |
| `{applications}`  | `/Applications`           | Applications folder   |
| `{volumes}`       | `/Volumes`                | Volumes mount point   |
| `{downloads}`     | `/Users/<user>/Downloads` | User downloads        |
| `{launchdaemons}` | `/Library/LaunchDaemons`  | System launch daemons |
| `{launchagents}`  | `/Library/LaunchAgents`   | Launch agents         |

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="148.333251953125">Variable</th><th width="175.666748046875">Linux example</th><th width="183.333251953125">macOS example</th><th>Description</th></tr></thead><tbody><tr><td><code>{bin}</code></td><td><code>/bin</code></td><td><code>/bin</code></td><td>Binaries</td></tr><tr><td><code>{etc}</code></td><td><code>/etc</code></td><td><code>/etc</code></td><td>Configuration</td></tr><tr><td><code>{tmp}</code></td><td><code>/tmp</code></td><td><code>/tmp</code></td><td>Temp</td></tr><tr><td><code>{usr}</code></td><td><code>/usr</code></td><td><code>/usr</code></td><td>User programs</td></tr><tr><td><code>{var}</code></td><td><code>/var</code></td><td><code>/var</code></td><td>Variable data</td></tr><tr><td><code>{home}</code></td><td><code>/home/&#x3C;user></code></td><td><code>/Users/&#x3C;user></code></td><td>User home</td></tr></tbody></table>

| Variable       | Description                | Example (Windows)                                 |
| -------------- | -------------------------- | ------------------------------------------------- |
| `{approot}`    | Application root directory | `C:\Program Files\KeeperPrivilegeManager`         |
| `{pluginroot}` | Plugins directory          | `C:\Program Files\KeeperPrivilegeManager\Plugins` |
| `{jobroot}`    | Jobs directory             | `C:\Program Files\KeeperPrivilegeManager\Jobs`    |

## **Path Variables**

**Path variables** are placeholders like `{userprofile}` or `{system32}` that resolve to real paths on each machine. They let you write one policy or job that works on every supported OS and install location.

* **Format:** `{variableName}` — curly braces, no `$` prefix.
* **Case:** Resolved case-insensitively on Windows; case-sensitive on Linux and macOS.
* **When resolved:** At evaluation time (when the policy or job runs), not when the file is saved.

### Common Path Variables (all platforms)

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Variable</th><th>Windows example</th><th>Linux example</th><th>macOS example</th><th>Description</th></tr></thead><tbody><tr><td><code>{rootdir}</code></td><td><code>C:\</code></td><td><code>/</code></td><td><code>/</code></td><td>Drive or filesystem root</td></tr><tr><td><code>{documents}</code></td><td><code>C:\Users\&#x3C;user>\Documents</code></td><td><code>/home/&#x3C;user>/Documents</code></td><td><code>/Users/&#x3C;user>/Documents</code></td><td>User documents folder</td></tr><tr><td><code>{userdocuments}</code></td><td>Same as <code>{documents}</code></td><td>Same as <code>{documents}</code></td><td>Same as <code>{documents}</code></td><td>Alias for documents</td></tr><tr><td><code>{userdesktop}</code></td><td><code>C:\Users\&#x3C;user>\Desktop</code></td><td><code>/home/&#x3C;user>/Desktop</code></td><td><code>/Users/&#x3C;user>/Desktop</code></td><td>User desktop</td></tr><tr><td><code>{hasdesktop}</code></td><td><code>"true"</code> / <code>"false"</code></td><td><code>"true"</code> / <code>"false"</code></td><td><code>"true"</code> / <code>"false"</code></td><td>Whether a desktop environment is present</td></tr></tbody></table>

### Windows-Specific Path Variables

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="179.6666259765625">Variable</th><th>Typical value</th><th>Description</th></tr></thead><tbody><tr><td><code>{systemroot}</code></td><td><code>C:\Windows</code></td><td>Windows directory</td></tr><tr><td><code>{windows}</code></td><td><code>C:\Windows</code></td><td>Alias for systemroot</td></tr><tr><td><code>{systemdrive}</code></td><td><code>C:</code></td><td>System drive (no trailing backslash)</td></tr><tr><td><code>{system32}</code></td><td><code>C:\Windows\System32</code></td><td>System32 directory</td></tr><tr><td><code>{syswow64}</code></td><td><code>C:\Windows\SysWOW64</code></td><td>32-bit system on 64-bit Windows</td></tr><tr><td><code>{programfiles}</code></td><td><code>C:\Program Files</code></td><td>Program Files</td></tr><tr><td><code>{programfilesx86}</code></td><td><code>C:\Program Files (x86)</code></td><td>Program Files (x86)</td></tr><tr><td><code>{userprofile}</code></td><td><code>C:\Users\&#x3C;user></code></td><td>User profile directory</td></tr><tr><td><code>{appdata}</code></td><td><code>C:\Users\&#x3C;user>\AppData\Roaming</code></td><td>Roaming AppData</td></tr><tr><td><code>{localappdata}</code></td><td><code>C:\Users\&#x3C;user>\AppData\Local</code></td><td>Local AppData</td></tr><tr><td><code>{programdata}</code></td><td><code>C:\ProgramData</code></td><td>ProgramData</td></tr><tr><td><code>{temp}</code></td><td><code>C:\Users\&#x3C;user>\AppData\Local\Temp</code></td><td>User temp directory</td></tr></tbody></table>

### **macOS Specific Path Variables**

<table><thead><tr><th width="159.87884521484375">Variable</th><th width="226.57574462890625">Example</th><th>Description</th></tr></thead><tbody><tr><td><code>{system}</code></td><td><code>/System</code></td><td>System root</td></tr><tr><td><code>{library}</code></td><td><code>/Library</code></td><td>Library</td></tr><tr><td><code>{applications}</code></td><td><code>/Applications</code></td><td>Applications folder</td></tr><tr><td><code>{volumes}</code></td><td><code>/Volumes</code></td><td>Volumes mount point</td></tr><tr><td><code>{downloads}</code></td><td><code>/Users/&#x3C;user>/Downloads</code></td><td>User downloads</td></tr><tr><td><code>{launchdaemons}</code></td><td><code>/Library/LaunchDaemons</code></td><td>System launch daemons</td></tr><tr><td><code>{launchagents}</code></td><td><code>/Library/LaunchAgents</code></td><td>Launch agents</td></tr></tbody></table>

### Linux and macOS Shared Path Variables

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="109.54537963867188">Variable</th><th width="133.2425537109375">Linux example</th><th width="148.1817626953125">macOS example</th><th>Description</th></tr></thead><tbody><tr><td><code>{bin}</code></td><td><code>/bin</code></td><td><code>/bin</code></td><td>Binaries</td></tr><tr><td><code>{etc}</code></td><td><code>/etc</code></td><td><code>/etc</code></td><td>Configuration</td></tr><tr><td><code>{tmp}</code></td><td><code>/tmp</code></td><td><code>/tmp</code></td><td>Temp</td></tr><tr><td><code>{usr}</code></td><td><code>/usr</code></td><td><code>/usr</code></td><td>User programs</td></tr><tr><td><code>{var}</code></td><td><code>/var</code></td><td><code>/var</code></td><td>Variable data</td></tr><tr><td><code>{home}</code></td><td><code>/home/&#x3C;user></code></td><td><code>/Users/&#x3C;user></code></td><td>User home</td></tr></tbody></table>

### Application-Specific Path Variables

These resolve relative to the Keeper Privilege Manager install:

<table><thead><tr><th width="134.787841796875">Variable</th><th width="159.8787841796875">Description</th><th>Example (Windows)</th></tr></thead><tbody><tr><td><code>{approot}</code></td><td>Application root directory</td><td><code>C:\Program Files\KeeperPrivilegeManager</code></td></tr><tr><td><code>{pluginroot}</code></td><td>Plugins directory</td><td><code>C:\Program Files\KeeperPrivilegeManager\Plugins</code></td></tr><tr><td><code>{jobroot}</code></td><td>Jobs directory</td><td><code>C:\Program Files\KeeperPrivilegeManager\Jobs</code></td></tr></tbody></table>

Use them in plugin configs or job paths so paths stay correct regardless of install location.

### User-Specific vs System Variables

* **User-specific:** `{userprofile}`, `{documents}`, `{userdesktop}`, `{appdata}`, `{temp}`, `{home}`, `{downloads}` — resolve to the **requesting user’s** paths (e.g., the user whose action triggered the policy).
* **System:** `{systemroot}`, `{system32}`, `{programfiles}`, `{programdata}`, `{bin}`, `{etc}` — resolve to the same path for all users on that machine.

### Custom Path Variables

Some deployments support **custom** path variables (e.g., in application or path-resolution settings). If available, you can define names like `{companyshare}` or `{deployroot}` and reference them in policies or jobs the same way as built-in variables. Check your configuration or admin console for where to define them.

***

## Protected Paths

{% hint style="info" %}

#### Protected Paths are essential for File Access Policies

Protected Paths are a safeguard built into File Access Policy evaluation. When a File Access Policy uses a wildcard — for example, denying all `*.exe` files in a folder — that pattern could inadvertently match critical operating system binaries in system directories like `C:\Windows\System32` or `/usr/bin`, breaking normal OS operation. To prevent this, KEPM maintains a per-platform list of protected directories where wildcard DENY policies are automatically bypassed, no matter how broad the pattern is. Explicit path policies are always evaluated regardless of protection status, so you can still enforce File Access controls against specific executables inside protected directories when needed.
{% endhint %}

On Windows, certain paths are **protected**: executables in those locations are excluded from wildcard DENY file-access policies so critical system binaries are not blocked. Protected paths typically include:

* `{systemroot}` (and key subdirs such as System32, WinSxS, Microsoft.NET, Boot, recovery)
* `{programfiles}` and `{programfilesx86}`

Protected path lists can be extended by configuration or policy. Use this when designing file-access policies so you don’t accidentally deny system executables.

#### Linux Default Protected Paths

Executables in these paths are excluded from wildcard File Access DENY policies. Protection applies recursively to all subdirectories. Explicit path policies are always evaluated regardless of protection status.

<table><thead><tr><th width="144.15155029296875">Path</th><th>Description</th></tr></thead><tbody><tr><td><code>/bin</code></td><td>Essential system binaries</td></tr><tr><td><code>/sbin</code></td><td>System administration binaries</td></tr><tr><td><code>/usr/bin</code></td><td>User-facing system utilities</td></tr><tr><td><code>/usr/sbin</code></td><td>System administration utilities</td></tr><tr><td><code>/usr/lib</code></td><td>System shared libraries</td></tr><tr><td><code>/usr/libexec</code></td><td>System daemon executables</td></tr><tr><td><code>/lib</code></td><td>Essential shared libraries</td></tr><tr><td><code>/lib64</code></td><td>64-bit essential shared libraries</td></tr><tr><td><code>/etc</code></td><td>System configuration files</td></tr><tr><td><code>/etc/passwd</code></td><td>User account database</td></tr><tr><td><code>/etc/shadow</code></td><td>Encrypted user password store</td></tr><tr><td><code>/etc/sudoers</code></td><td>sudo privilege configuration</td></tr><tr><td><code>/boot</code></td><td>Boot loader and kernel files</td></tr><tr><td><code>/dev</code></td><td>Device files</td></tr><tr><td><code>/proc</code></td><td>Kernel and process information (virtual filesystem)</td></tr><tr><td><code>/sys</code></td><td>Hardware and driver information (virtual filesystem)</td></tr><tr><td><code>/opt/keeper</code></td><td>Keeper Privilege Manager installation directory</td></tr></tbody></table>

#### Linux High-Risk Paths

The following paths contain critical system files and should never be targeted by File Access policies. Modification to files in these locations can corrupt authentication, disable system initialization, or render the system unbootable.

<table><thead><tr><th width="139.272705078125">Path</th><th width="175.36358642578125">Description</th><th>Risk</th></tr></thead><tbody><tr><td><code>/etc/passwd</code></td><td>User account database</td><td>Corruption breaks all user authentication system-wide</td></tr><tr><td><code>/etc/shadow</code></td><td>Encrypted user password store</td><td>Corruption prevents password-based login for all users</td></tr><tr><td><code>/bin/sh</code></td><td>Default system shell</td><td>Corruption breaks scripts, system init, and recovery tools that depend on <code>sh</code></td></tr><tr><td><code>/sbin/init</code></td><td>System initialization process (PID 1)</td><td>Corruption prevents the OS from booting</td></tr></tbody></table>

{% hint style="info" %}
Learn more about how  [**Policy: Wildcards**](/keeperpam/endpoint-privilege-manager/policies/wildcards.md) behave in application vs. folder filters and what to avoid.
{% endhint %}

#### Generic Unix Default Protected Paths

These paths serve as the fallback protected directory set for Unix-based environments where a platform-specific list is not defined. Explicit path policies are always evaluated regardless of protection status.

<table><thead><tr><th width="119.15155029296875">Path</th><th>Description</th></tr></thead><tbody><tr><td><code>/bin</code></td><td>Essential system binaries</td></tr><tr><td><code>/sbin</code></td><td>System administration binaries</td></tr><tr><td><code>/usr/bin</code></td><td>User-facing system utilities</td></tr><tr><td><code>/usr/sbin</code></td><td>System administration utilities</td></tr><tr><td><code>/etc</code></td><td>System configuration files</td></tr><tr><td><code>/dev</code></td><td>Device files</td></tr><tr><td><code>/proc</code></td><td>Kernel and process information (virtual filesystem)</td></tr><tr><td><code>/sys</code></td><td>Hardware and driver information (virtual filesystem)</td></tr></tbody></table>

#### macOS Default Protected Paths

Wildcard File Access DENY policies are bypassed for executables in these paths. Explicit path policies are always evaluated regardless of protection status.

<table><thead><tr><th width="230.66668701171875">Path</th><th>Description</th></tr></thead><tbody><tr><td><code>/System</code></td><td>macOS system root and all subdirectories</td></tr><tr><td><code>/bin</code></td><td>Essential system binaries</td></tr><tr><td><code>/sbin</code></td><td>System administration binaries</td></tr><tr><td><code>/usr/bin</code></td><td>User-facing system utilities</td></tr><tr><td><code>/usr/sbin</code></td><td>System administration utilities</td></tr><tr><td><code>/private/etc</code></td><td>System configuration files</td></tr><tr><td><code>/Library/Security</code></td><td>Security framework</td></tr><tr><td><code>/Applications/Utilities</code></td><td>Built-in utility applications</td></tr><tr><td><code>/Applications</code></td><td>All applications in the main Applications directory</td></tr><tr><td><code>/System/Applications</code></td><td>Built-in macOS applications</td></tr></tbody></table>

#### macOS High-Risk Paths

The following paths contain critical system files and should never be targeted by File Access policies. Modification to files in these locations can corrupt core OS services, break authentication, or render the system unbootable.

| Path                           | Description                                                                        | Risk                                                                                                                          |
| ------------------------------ | ---------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| `/System/Library/CoreServices` | Core macOS system services including the Finder, WindowServer, and boot components | Corruption breaks system startup, the GUI environment, or both                                                                |
| `/private/etc`                 | System configuration files (also accessible as `/etc`)                             | Corruption to files such as `passwd`, `sudoers`, or `hosts` breaks authentication, privilege resolution, and network behavior |

{% hint style="success" %}
`/Applications` and `/System/Applications` are protected by design. For the full rationale and guidance on where to scope wildcard vs. explicit path policies, see [macOS Protected Path Design Intent](/keeperpam/endpoint-privilege-manager/reference/macos-protected-path-design-intent.md) for greater detail.
{% endhint %}

### Windows Default Protected Paths

Executables in these paths are excluded from wildcard File Access DENY policies. Protection is recursive — all subdirectories are included. Explicit path policies are always evaluated regardless of protection status.

The list can be extended via a ProtectedPaths policy or the `UserProtectedDirectories.json` / `PolicyProtectedDirectories.json` files under the PathResolution storage folder.

| Variable                          | Resolves To (Typical)                                          | Description                                     |
| --------------------------------- | -------------------------------------------------------------- | ----------------------------------------------- |
| `{systemroot}`                    | `C:\Windows`                                                   | Windows directory root and all subdirectories   |
| `{system32}`                      | `C:\Windows\System32`                                          | Core system binaries                            |
| `{systemroot}\SysWOW64`           | `C:\Windows\SysWOW64`                                          | 32-bit system binaries on 64-bit Windows        |
| `{systemroot}\WinSxS`             | `C:\Windows\WinSxS`                                            | Side-by-side component assemblies               |
| `{systemroot}\servicing`          | `C:\Windows\servicing`                                         | Windows Update and Servicing Stack              |
| `{systemroot}\Microsoft.NET`      | `C:\Windows\Microsoft.NET`                                     | .NET Framework runtime files                    |
| `{systemroot}\assembly`           | `C:\Windows\assembly`                                          | Global Assembly Cache (GAC)                     |
| `{systemroot}\Boot`               | `C:\Windows\Boot`                                              | Boot manager files                              |
| `{systemroot}\recovery`           | `C:\Windows\recovery`                                          | Windows Recovery Environment                    |
| `{systemroot}\System32\config`    | `C:\Windows\System32\config`                                   | Registry hive files                             |
| `{systemroot}\System32\drivers`   | `C:\Windows\System32\drivers`                                  | Kernel-mode device drivers                      |
| `{programfiles}`                  | `C:\Program Files`                                             | Installed 64-bit applications                   |
| `{programfilesx86}`               | `C:\Program Files (x86)`                                       | Installed 32-bit applications on 64-bit Windows |
| `{programfiles}\Windows Defender` | `C:\Program Files\Windows Defender`                            | Windows Defender antivirus binaries             |
| `{programfiles}\Windows NT`       | `C:\Program Files\Windows NT`                                  | Core Windows NT components                      |
| N/A                               | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup` | System startup programs                         |

#### Windows High-Risk Paths

The following paths contain critical system files and should never be targeted by File Access policies. Modification to files in these locations can corrupt the registry, destabilize drivers, or render the system unbootable.

| Path                          | Description                                                   | Risk                                        |
| ----------------------------- | ------------------------------------------------------------- | ------------------------------------------- |
| `C:\Windows\System32\config`  | Registry hive files (`SYSTEM`, `SAM`, `SECURITY`, `SOFTWARE`) | Registry corruption; system unbootable      |
| `C:\Windows\System32\drivers` | Kernel-mode device drivers (`.sys` files)                     | Driver failure; Blue Screen of Death (BSOD) |


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/endpoint-privilege-manager/policies/path-variables.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.