# File Access

<figure><img src="/files/9fRiryog2yssqdLTbNNy" alt=""><figcaption></figcaption></figure>

## Overview

File Access policies control access to specific files, implementing fine-grained access control for sensitive data, configuration files and system files.

The file access policy restricts access to **executable files** and **non-executable** files.

File Access policies may operate within broader default-deny enforcement models, requiring explicit authorization or policy approval before sensitive files can be accessed or executed.

## How it Works

* Executable files are restricted at the point of execution, similar to the elevation policy.
* Non-executable file enforcement, which leverages the native operating system's ACLs, (e.g. text file, database file, configuration file, etc) will deny `READ/WRITE/DELETE` of the file without adhering to the enforcement (MFA, justification, approval).
* The File Access policy will apply to **any user** of the system, not just a standard user.
* File Access requests can be initiated from both the Keeper Client and command-line interface, ensuring consistent enforcement and workflow parity across user interaction models.

### Special Considerations

* If you have file access and elevation policy on the same executable, the file access policy won't apply and Keeper will **only** apply the elevation policy.
* File Access policy evaluation may incorporate contextual risk signals as part of enforcement decisions, supporting organizations that align file governance with broader risk management strategies.
* Keeper supports [Path Variables](#path-variables) for assigning policy to a common folder or path on the endpoint.
* Keeper modifies the ACL of a target file explicitly to a user that the policy has been applied to. Keeper will explicitly add the user, then apply the ACL. When a user requests access to a file, and the file access is approved, Keeper modifies the ACL for that user read/write permission to "allow". On Linux systems, if the user is a member of a group which already has "allow" permissions, the user will be able to access the file based on their group membership, regardless of what Keeper enforces.

***

{% stepper %}
{% step %}
**Create an Application Collection**

Before creating the policy, the target files must be organized into an **Application Collection**. Navigate to **Collections → Applications** and click on the <mark style="color:blue;">**New Collection**</mark> button. This will bring up the **New Collection** modal form. Select **Applications** from the Type select box, give your collection a recognizable descriptive name, and click the <mark style="color:blue;">**Next**</mark> button.

<figure><img src="/files/NrHR3lToBcy9f8J9R0Tc" alt="" width="375"><figcaption></figcaption></figure>

You sholud now see the **Add Item to Collection** modal form. You can either Type object to add and select from the objects that match the string that you type, or you can check the **Manually define resource** checkbox and manually define your resources.

Add each target file as a custom resource, using [Path Variables](broken://pages/E3BQ3kP4uECttGaKgOlA) where applicable to avoid hardcoded paths (e.g. `{system32}\powershell.exe`). Once you have selected or entered the resource that you want to add to your collection, click the **Add** button and repeat the process until youhave all of the resources that you would like to see in your application collection added.

<div><figure><img src="/files/ehFoZ17ZJnwWHjIYnegf" alt="" width="375"><figcaption></figcaption></figure> <figure><img src="/files/q9udYhe31AiviTpMwAKK" alt="" width="375"><figcaption></figcaption></figure></div>

> **Tip:** Give the collection a descriptive name that reflects its purpose — for example, "Restricted System Tools" or "Protected Config Files" — to make it easy to identify when assigning it to a policy.

<figure><img src="/files/p7DepsRB8iDqlZJyBdXz" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Open the Policy Form**

From the Keeper Admin Console, navigate to **Endpoint Privilege Manager → Policies** and click <mark style="color:blue;">**Create Policy**</mark>. This will open the Create Policy modal form.

<figure><img src="/files/yZIYnDC2ECDHSa6PoJHu" alt="" width="375"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Configure the Policy**

Fill in the policy details:

* **Policy Name** — Enter a descriptive name (e.g. `File Access – Restricted System Tools`, `File Access – Protected Config Files`)
* **Policy Type** — Select `File Access`
* **Status** — Select `Enforce` to apply the policy actively

<figure><img src="/files/pWbRdETnHxqRhmoYMa4g" alt="" width="375"><figcaption></figcaption></figure>

> **Tip:** Consider starting with **Monitor** status to observe how frequently the policy would match before enabling enforcement.
> {% endstep %}

{% step %}
**Select a Control**

Click **Add Control** and select the control to apply when a user triggers an elevation event:

* **Require Approval** — Elevation is blocked until an assigned approver grants the request
* **Require MFA** — User must verify their identity with a TOTP code before elevation proceeds
* **Require Justification** — User must provide a written reason before elevation proceeds

<figure><img src="/files/OfllkOqwRgl01jgNw273" alt="" width="375"><figcaption></figcaption></figure>

Multiple controls can be added to a single policy. When controls are stacked, all must be satisfied before the elevation is permitted.
{% endstep %}

{% step %}
**Set Policy Filters**

Below the **Add Control** button, define the scope of the policy by applying filters:

* **User Groups** — Select the user group collections to target, or choose **Select All** to apply to all users
* **Machines** — Select the machine collections to target, or choose **Select All** to apply to all enrolled endpoints
* **Applications** — Select the Application Collection created in Step 1
* **Date & Time Window** — Optionally restrict the policy to specific dates, days of the week, or time ranges

<figure><img src="/files/ut4FyfRLnuUUEDY8RWMM" alt="" width="375"><figcaption></figcaption></figure>

> Selecting **Select All** on any filter dimension creates a wildcard that automatically includes new users, machines, or applications added to those collections in the future.
> {% endstep %}

{% step %}
**Save and Deploy**

Once the form has been sufficiently filled in per the previous steps, the <mark style="color:blue;">**Save**</mark> button will be changed from an inactive to an active state. Click on the <mark style="color:blue;">**Save**</mark> button.

<div align="right"><figure><img src="/files/4PlnXaUxyroccfZRuKAT" alt="" width="44"><figcaption></figcaption></figure></div>

The policy will be pushed to all in-scope endpoints within approximately **30 minutes**. Users on affected endpoints can also trigger an immediate sync via the **Refresh Policies** option in the Keeper agent.

When the policy is applied, affected users will receive an on-screen notification informing them that they have been removed from the local Administrators group.
{% endstep %}
{% endstepper %}

## Example 1: File Access Policy on Executables

As an example, let's say you want to restrict users from executing specific applications that are typically only used by IT team members. This may prevent threats such as "living off the land" where malware takes advantage of common tools. A list of tools that fall into this category might look like this:

```
{system32}\cmd.exe
{system32}\certutil.exe
{system32}\cscript.exe
{system32}\PATHPING.EXE
{system32}\PING.EXE
{system32}\NDKPing.exe
{system32}\RpcPing.exe
{system32}\WMIC.exe
{system32}\WindowsPowerShell\v1.0\powershell.exe
{system32}\WindowsPowerShell\v1.0\powershell_ise.exe
```

{% stepper %}
{% step %}
**Create Collection**

In the **Collections** > **Applications**, create a new Collection. For example, this one is called "Restricted Files on Windows". Add the files to the collection as custom resources.

Note: the `{system32}` variable is defined in our list of [Path Variables](#path-variables).

<figure><img src="/files/ZyIAgJcMnphUd1ePKeUA" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**Create File Access Policy**

From the Policies screen, create a "File Access" policy that has specific controls. The application collection assigned is the "Restricted Files on Windows" collection.

<figure><img src="/files/5dUbYfyktGcnpVPA6yPG" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}
**User Experience**

When the user (in this case, the "standard" user) attempts to execute any of the applications listed, they will receive a prompt from Keeper that requests justification and approval.

<figure><img src="/files/jETZxdSBEuDKtTCMGIfF" alt="" width="184"><figcaption></figcaption></figure>

After the request is approved, the Keeper Client application will display the request. The user can then launch it directly from the user interface.

<figure><img src="/files/aAto8XWDwpXJ8Zlwhlei" alt="" width="180"><figcaption></figcaption></figure>
{% endstep %}
{% endstepper %}

## Example 2: Protection of a System File

In this example, we will require approval to access a protected file called "netlogon.inf" on all Windows machines.

{% stepper %}
{% step %}
**Create Collection**

Create a "Protected Files" collection which will hold the protected file resources.

<figure><img src="/files/Zj9y5peebTnOVGdKK1lj" alt=""><figcaption><p>Create a new Collection of Protected Files</p></figcaption></figure>
{% endstep %}

{% step %}
**Add Item to Collection**

Click on "Manually define resource" and add the `netlogon.inf` file to the collection.

<figure><img src="/files/yxRgTXWTMYNex4QlEpOK" alt=""><figcaption><p>Add Item to Collection</p></figcaption></figure>
{% endstep %}

{% step %}
**Create a Policy**

From the Policy tab, click on Create Policy and select:

**Policy Type**: File Access

**Status**: Enforce

**Add Control**: Select MFA, Justification or Approval

**User Groups**: Select the users or groups affected, or All Users and Groups

**Machines**: Select which machines to apply the policy, or All Machines

**Applications**: Select the "Protected Files" collection as defined above.

<figure><img src="/files/AJY0iDWFMT0G39KW9pRe" alt=""><figcaption><p>Create Policy</p></figcaption></figure>

To require approval by an admin for accessing the file resource, select "Requires Approval" and then select the approver(s).

<figure><img src="/files/Yw1MUdRzNSDDjuZZDPRB" alt=""><figcaption><p>Require Approval on File Access</p></figcaption></figure>

After saving the policy, it will apply to all affected machines within a few minutes.
{% endstep %}
{% endstepper %}

When defining a File Access policy, variables can be used to simplify the policy creation process, and to avoid hard-coded paths.

## **Path Variables**

**Path variables** are placeholders like `{userprofile}` or `{system32}` that resolve to real paths on each machine. They let you write one policy or job that works on every supported OS and install location.

* **Format:** `{variableName}` — curly braces, no `$` prefix.
* **Case:** Resolved case-insensitively on Windows; case-sensitive on Linux and macOS.
* **When resolved:** At evaluation time (when the policy or job runs), not when the file is saved.

### Common Path Variables (all platforms)

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Variable</th><th>Windows example</th><th>Linux example</th><th>macOS example</th><th>Description</th></tr></thead><tbody><tr><td><code>{rootdir}</code></td><td><code>C:\</code></td><td><code>/</code></td><td><code>/</code></td><td>Drive or filesystem root</td></tr><tr><td><code>{documents}</code></td><td><code>C:\Users\&#x3C;user>\Documents</code></td><td><code>/home/&#x3C;user>/Documents</code></td><td><code>/Users/&#x3C;user>/Documents</code></td><td>User documents folder</td></tr><tr><td><code>{userdocuments}</code></td><td>Same as <code>{documents}</code></td><td>Same as <code>{documents}</code></td><td>Same as <code>{documents}</code></td><td>Alias for documents</td></tr><tr><td><code>{userdesktop}</code></td><td><code>C:\Users\&#x3C;user>\Desktop</code></td><td><code>/home/&#x3C;user>/Desktop</code></td><td><code>/Users/&#x3C;user>/Desktop</code></td><td>User desktop</td></tr><tr><td><code>{hasdesktop}</code></td><td><code>"true"</code> / <code>"false"</code></td><td><code>"true"</code> / <code>"false"</code></td><td><code>"true"</code> / <code>"false"</code></td><td>Whether a desktop environment is present</td></tr></tbody></table>

### Windows-Specific Path Variables

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="179.6666259765625">Variable</th><th>Typical value</th><th>Description</th></tr></thead><tbody><tr><td><code>{systemroot}</code></td><td><code>C:\Windows</code></td><td>Windows directory</td></tr><tr><td><code>{windows}</code></td><td><code>C:\Windows</code></td><td>Alias for systemroot</td></tr><tr><td><code>{systemdrive}</code></td><td><code>C:</code></td><td>System drive (no trailing backslash)</td></tr><tr><td><code>{system32}</code></td><td><code>C:\Windows\System32</code></td><td>System32 directory</td></tr><tr><td><code>{syswow64}</code></td><td><code>C:\Windows\SysWOW64</code></td><td>32-bit system on 64-bit Windows</td></tr><tr><td><code>{programfiles}</code></td><td><code>C:\Program Files</code></td><td>Program Files</td></tr><tr><td><code>{programfilesx86}</code></td><td><code>C:\Program Files (x86)</code></td><td>Program Files (x86)</td></tr><tr><td><code>{userprofile}</code></td><td><code>C:\Users\&#x3C;user></code></td><td>User profile directory</td></tr><tr><td><code>{appdata}</code></td><td><code>C:\Users\&#x3C;user>\AppData\Roaming</code></td><td>Roaming AppData</td></tr><tr><td><code>{localappdata}</code></td><td><code>C:\Users\&#x3C;user>\AppData\Local</code></td><td>Local AppData</td></tr><tr><td><code>{programdata}</code></td><td><code>C:\ProgramData</code></td><td>ProgramData</td></tr><tr><td><code>{temp}</code></td><td><code>C:\Users\&#x3C;user>\AppData\Local\Temp</code></td><td>User temp directory</td></tr></tbody></table>

### **macOS Specific Path Variables**

<table><thead><tr><th width="159.87884521484375">Variable</th><th width="226.57574462890625">Example</th><th>Description</th></tr></thead><tbody><tr><td><code>{system}</code></td><td><code>/System</code></td><td>System root</td></tr><tr><td><code>{library}</code></td><td><code>/Library</code></td><td>Library</td></tr><tr><td><code>{applications}</code></td><td><code>/Applications</code></td><td>Applications folder</td></tr><tr><td><code>{volumes}</code></td><td><code>/Volumes</code></td><td>Volumes mount point</td></tr><tr><td><code>{downloads}</code></td><td><code>/Users/&#x3C;user>/Downloads</code></td><td>User downloads</td></tr><tr><td><code>{launchdaemons}</code></td><td><code>/Library/LaunchDaemons</code></td><td>System launch daemons</td></tr><tr><td><code>{launchagents}</code></td><td><code>/Library/LaunchAgents</code></td><td>Launch agents</td></tr></tbody></table>

### Linux and macOS Shared Path Variables

<table data-header-hidden="false" data-header-sticky><thead><tr><th width="109.54537963867188">Variable</th><th width="133.2425537109375">Linux example</th><th width="148.1817626953125">macOS example</th><th>Description</th></tr></thead><tbody><tr><td><code>{bin}</code></td><td><code>/bin</code></td><td><code>/bin</code></td><td>Binaries</td></tr><tr><td><code>{etc}</code></td><td><code>/etc</code></td><td><code>/etc</code></td><td>Configuration</td></tr><tr><td><code>{tmp}</code></td><td><code>/tmp</code></td><td><code>/tmp</code></td><td>Temp</td></tr><tr><td><code>{usr}</code></td><td><code>/usr</code></td><td><code>/usr</code></td><td>User programs</td></tr><tr><td><code>{var}</code></td><td><code>/var</code></td><td><code>/var</code></td><td>Variable data</td></tr><tr><td><code>{home}</code></td><td><code>/home/&#x3C;user></code></td><td><code>/Users/&#x3C;user></code></td><td>User home</td></tr></tbody></table>

### Application-Specific Path Variables

These resolve relative to the Keeper Privilege Manager install:

<table><thead><tr><th width="134.787841796875">Variable</th><th width="159.8787841796875">Description</th><th>Example (Windows)</th></tr></thead><tbody><tr><td><code>{approot}</code></td><td>Application root directory</td><td><code>C:\Program Files\KeeperPrivilegeManager</code></td></tr><tr><td><code>{pluginroot}</code></td><td>Plugins directory</td><td><code>C:\Program Files\KeeperPrivilegeManager\Plugins</code></td></tr><tr><td><code>{jobroot}</code></td><td>Jobs directory</td><td><code>C:\Program Files\KeeperPrivilegeManager\Jobs</code></td></tr></tbody></table>

## Protected Paths

Keeper Endpoint Privilege Manager maintains a comprehensive list of protected paths across all supported platforms. These paths represent critical system directories and files that should not be modified by standard users and are excluded from ACL enforcement to maintain system integrity.

### Protection Categories

#### 1. Protected Directories

System directories that are automatically protected from ACL modifications.

#### 2. High-Risk Paths

Critical system files that should never be modified and are blocked from storage operations.

#### 3. Critical System Paths

Virtual filesystems and problematic paths that are avoided during inventory scanning.

## Platform-Specific Protected Paths

#### Linux Default Protected Paths

Executables in these paths are excluded from wildcard File Access DENY policies. Protection applies recursively to all subdirectories. Explicit path policies are always evaluated regardless of protection status.

<table><thead><tr><th width="144.15155029296875">Path</th><th>Description</th></tr></thead><tbody><tr><td><code>/bin</code></td><td>Essential system binaries</td></tr><tr><td><code>/sbin</code></td><td>System administration binaries</td></tr><tr><td><code>/usr/bin</code></td><td>User-facing system utilities</td></tr><tr><td><code>/usr/sbin</code></td><td>System administration utilities</td></tr><tr><td><code>/usr/lib</code></td><td>System shared libraries</td></tr><tr><td><code>/usr/libexec</code></td><td>System daemon executables</td></tr><tr><td><code>/lib</code></td><td>Essential shared libraries</td></tr><tr><td><code>/lib64</code></td><td>64-bit essential shared libraries</td></tr><tr><td><code>/etc</code></td><td>System configuration files</td></tr><tr><td><code>/etc/passwd</code></td><td>User account database</td></tr><tr><td><code>/etc/shadow</code></td><td>Encrypted user password store</td></tr><tr><td><code>/etc/sudoers</code></td><td>sudo privilege configuration</td></tr><tr><td><code>/boot</code></td><td>Boot loader and kernel files</td></tr><tr><td><code>/dev</code></td><td>Device files</td></tr><tr><td><code>/proc</code></td><td>Kernel and process information (virtual filesystem)</td></tr><tr><td><code>/sys</code></td><td>Hardware and driver information (virtual filesystem)</td></tr><tr><td><code>/opt/keeper</code></td><td>Keeper Privilege Manager installation directory</td></tr></tbody></table>

#### Linux High-Risk Paths

The following paths contain critical system files and should never be targeted by File Access policies. Modification to files in these locations can corrupt authentication, disable system initialization, or render the system unbootable.

<table><thead><tr><th width="139.272705078125">Path</th><th width="175.36358642578125">Description</th><th>Risk</th></tr></thead><tbody><tr><td><code>/etc/passwd</code></td><td>User account database</td><td>Corruption breaks all user authentication system-wide</td></tr><tr><td><code>/etc/shadow</code></td><td>Encrypted user password store</td><td>Corruption prevents password-based login for all users</td></tr><tr><td><code>/bin/sh</code></td><td>Default system shell</td><td>Corruption breaks scripts, system init, and recovery tools that depend on <code>sh</code></td></tr><tr><td><code>/sbin/init</code></td><td>System initialization process (PID 1)</td><td>Corruption prevents the OS from booting</td></tr></tbody></table>

{% hint style="info" %}
Learn more about how  [**Policy: Wildcards**](/keeperpam/endpoint-privilege-manager/policies/wildcards.md) behave in application vs. folder filters and what to avoid.
{% endhint %}

#### Generic Unix Default Protected Paths

These paths serve as the fallback protected directory set for Unix-based environments where a platform-specific list is not defined. Explicit path policies are always evaluated regardless of protection status.

<table><thead><tr><th width="119.15155029296875">Path</th><th>Description</th></tr></thead><tbody><tr><td><code>/bin</code></td><td>Essential system binaries</td></tr><tr><td><code>/sbin</code></td><td>System administration binaries</td></tr><tr><td><code>/usr/bin</code></td><td>User-facing system utilities</td></tr><tr><td><code>/usr/sbin</code></td><td>System administration utilities</td></tr><tr><td><code>/etc</code></td><td>System configuration files</td></tr><tr><td><code>/dev</code></td><td>Device files</td></tr><tr><td><code>/proc</code></td><td>Kernel and process information (virtual filesystem)</td></tr><tr><td><code>/sys</code></td><td>Hardware and driver information (virtual filesystem)</td></tr></tbody></table>

#### macOS Default Protected Paths

Wildcard File Access DENY policies are bypassed for executables in these paths. Explicit path policies are always evaluated regardless of protection status.

<table><thead><tr><th width="230.66668701171875">Path</th><th>Description</th></tr></thead><tbody><tr><td><code>/System</code></td><td>macOS system root and all subdirectories</td></tr><tr><td><code>/bin</code></td><td>Essential system binaries</td></tr><tr><td><code>/sbin</code></td><td>System administration binaries</td></tr><tr><td><code>/usr/bin</code></td><td>User-facing system utilities</td></tr><tr><td><code>/usr/sbin</code></td><td>System administration utilities</td></tr><tr><td><code>/private/etc</code></td><td>System configuration files</td></tr><tr><td><code>/Library/Security</code></td><td>Security framework</td></tr><tr><td><code>/Applications/Utilities</code></td><td>Built-in utility applications</td></tr><tr><td><code>/Applications</code></td><td>All applications in the main Applications directory</td></tr><tr><td><code>/System/Applications</code></td><td>Built-in macOS applications</td></tr></tbody></table>

#### macOS High-Risk Paths

The following paths contain critical system files and should never be targeted by File Access policies. Modification to files in these locations can corrupt core OS services, break authentication, or render the system unbootable.

| Path                           | Description                                                                        | Risk                                                                                                                          |
| ------------------------------ | ---------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| `/System/Library/CoreServices` | Core macOS system services including the Finder, WindowServer, and boot components | Corruption breaks system startup, the GUI environment, or both                                                                |
| `/private/etc`                 | System configuration files (also accessible as `/etc`)                             | Corruption to files such as `passwd`, `sudoers`, or `hosts` breaks authentication, privilege resolution, and network behavior |

{% hint style="success" %}
`/Applications` and `/System/Applications` are protected by design. For the full rationale and guidance on where to scope wildcard vs. explicit path policies, see [macOS Protected Path Design Intent](/keeperpam/endpoint-privilege-manager/reference/macos-protected-path-design-intent.md) for greater detail.
{% endhint %}

### Windows Default Protected Paths

Executables in these paths are excluded from wildcard File Access DENY policies. Protection is recursive — all subdirectories are included. Explicit path policies are always evaluated regardless of protection status.

The list can be extended via a ProtectedPaths policy or the `UserProtectedDirectories.json` / `PolicyProtectedDirectories.json` files under the PathResolution storage folder.

| Variable                          | Resolves To (Typical)                                          | Description                                     |
| --------------------------------- | -------------------------------------------------------------- | ----------------------------------------------- |
| `{systemroot}`                    | `C:\Windows`                                                   | Windows directory root and all subdirectories   |
| `{system32}`                      | `C:\Windows\System32`                                          | Core system binaries                            |
| `{systemroot}\SysWOW64`           | `C:\Windows\SysWOW64`                                          | 32-bit system binaries on 64-bit Windows        |
| `{systemroot}\WinSxS`             | `C:\Windows\WinSxS`                                            | Side-by-side component assemblies               |
| `{systemroot}\servicing`          | `C:\Windows\servicing`                                         | Windows Update and Servicing Stack              |
| `{systemroot}\Microsoft.NET`      | `C:\Windows\Microsoft.NET`                                     | .NET Framework runtime files                    |
| `{systemroot}\assembly`           | `C:\Windows\assembly`                                          | Global Assembly Cache (GAC)                     |
| `{systemroot}\Boot`               | `C:\Windows\Boot`                                              | Boot manager files                              |
| `{systemroot}\recovery`           | `C:\Windows\recovery`                                          | Windows Recovery Environment                    |
| `{systemroot}\System32\config`    | `C:\Windows\System32\config`                                   | Registry hive files                             |
| `{systemroot}\System32\drivers`   | `C:\Windows\System32\drivers`                                  | Kernel-mode device drivers                      |
| `{programfiles}`                  | `C:\Program Files`                                             | Installed 64-bit applications                   |
| `{programfilesx86}`               | `C:\Program Files (x86)`                                       | Installed 32-bit applications on 64-bit Windows |
| `{programfiles}\Windows Defender` | `C:\Program Files\Windows Defender`                            | Windows Defender antivirus binaries             |
| `{programfiles}\Windows NT`       | `C:\Program Files\Windows NT`                                  | Core Windows NT components                      |
| N/A                               | `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup` | System startup programs                         |

#### Windows High-Risk Paths

The following paths contain critical system files and should never be targeted by File Access policies. Modification to files in these locations can corrupt the registry, destabilize drivers, or render the system unbootable.

| Path                          | Description                                                   | Risk                                        |
| ----------------------------- | ------------------------------------------------------------- | ------------------------------------------- |
| `C:\Windows\System32\config`  | Registry hive files (`SYSTEM`, `SAM`, `SECURITY`, `SOFTWARE`) | Registry corruption; system unbootable      |
| `C:\Windows\System32\drivers` | Kernel-mode device drivers (`.sys` files)                     | Driver failure; Blue Screen of Death (BSOD) |

### Mac and Linux Policy Enforcement

On macOS and Linux devices, the File Access policy currently requires the use of the Keeper Client application user interface. To request file access, the user has to request it via the system tray "**Request Access**" feature.

<figure><img src="/files/oojpFLHnQsGqlfB3WCqK" alt="" width="375"><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/endpoint-privilege-manager/policies/policy-types/file-access-policy-type.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.