# Gateway on Windows

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FMKUPFqx5R4qNbP4UvDEA%2FWindows%20Install.jpg?alt=media&#x26;token=a0bae005-cca1-4d63-9ab2-0c36c06b48b2" alt=""><figcaption></figcaption></figure>

## Overview

This document contains information on how to install, configure, and update the Keeper Gateway on Windows.

### Prerequisite

Prior to proceeding with this document, make sure you [created a Gateway device](/keeperpam/privileged-access-manager/getting-started/gateways/one-time-access-token.md).

### Installation

The latest Keeper Gateway for Windows is downloaded from here:

* [**Download the Keeper Gateway for Windows**](https://keepersecurity.com/pam/gateway/keeper-gateway_windows_x86_64.exe)

You can run the service under system privilege or use a service account.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FEmNFPFH1OL9YhIvTMxzz%2FScreenshot%202025-02-14%20at%204.47.50%E2%80%AFPM.png?alt=media&#x26;token=8e76ef63-658a-43fd-ab99-f7b8b89bdaf5" alt=""><figcaption><p>Keeper Gateway for Windows</p></figcaption></figure>

#### New Installs

Upon installation of the service, select "Enter a Keeper One-Time Access Token" and supply the token provided by when you [created a Gateway](/keeperpam/privileged-access-manager/getting-started/gateways/one-time-access-token.md) on the Vault. After installation, the service will automatically start up and register with the Keeper cloud.

#### Upgrading

If you are upgrading an existing Gateway, un-check the "Enter a Keeper One-Time Access Token" so that the existing configuration is maintained.

#### **Installation Location**

The default installation location is the following:

```
C:\ProgramFiles (x86)\Keeper Gateway\<version>
```

#### Setup Options

* Install Windows service - Installs the gateway as a Windows service.
  * Use service account - Use the [specified service account](#specifying-the-keeper-gateway-service-account-optional), otherwise the account installing the gateway will be used.
  * Start Windows service - Start the Keeper Gateway service immediately after installation
  * Enable automatic updates
* Turn on debug logging - Enable [verbose logging](#verbose-logging) on the gateway log files. NOT recommended for production environments. Only use this when debugging with Keeper support.
* Remove Keeper Gateway configuration and logs from previous installations

#### Specifying the Keeper Gateway Service Account

If "Use service account" is specified you will be prompted to enter the valid credentials of the desired service account:

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FIoAEQf7xnRCENtcZN8XF%2FwindowsInstaller%232.png?alt=media&#x26;token=6d330e57-ec06-4fb5-a450-66e9f2db3e8a" alt="" width="375"><figcaption><p>Service Account Setup</p></figcaption></figure>

#### One-Time Access Token

The final step prior to successfully installing the Keeper Gateway as service is to enter the [One-Time Access](/keeperpam/privileged-access-manager/getting-started/gateways/one-time-access-token.md) Token provided from the Keeper Vault.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F9IAdgaW9qb5yXpZF5Cj3%2FwindowsInstaller%233.png?alt=media&#x26;token=e53521b5-8f18-4de3-ae52-faa0c9dc105d" alt="" width="375"><figcaption></figcaption></figure>

After clicking "Next", click "Install" in the next screen to install the Keeper Gateway.

### Gateway Service Management

After installing and running the Keeper Gateway as a service, this service can be accessed and easily managed within the Windows Services Manager as "Keeper Gateway Service".

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FRPmmLYEln37uzuhGJnK1%2FScreenshot%202025-02-14%20at%204.54.23%E2%80%AFPM.png?alt=media&#x26;token=45d2a0bd-c544-4c8f-a0bb-37b1acab87ba" alt=""><figcaption><p>Keeper Gateway Service</p></figcaption></figure>

### **Configuration File**

The Keeper Gateway configuration file contains a set of tokens that includes encryption keys, client identifiers, and tenant server information used to authenticate and decrypt data from the Keeper Secrets Manager APIs. This configuration file is created from the One-Time Access Token generated when you [created the Gateway](/keeperpam/privileged-access-manager/getting-started/gateways/one-time-access-token.md).

If the Keeper Gateway is installed and running as a service, the gateway configuration file is stored in the following location:

```
C:\ProgramData\KeeperGateway\config\gateway-config.json
```

If the Keeper Gateway is installed locally and not running as a service, the gateway configuration file is stored in the following location:

```
C:\Users\<User>\.keeper\gateway-config.json
```

### **Log files**

Logs that contain helpful debugging information are automatically created and stored on the local machine.

If the gateway is running as a service, the gateway log files are stored in the following location:

```
C:\ProgramData\KeeperGateway\logs\
```

If the gateway is not running as a service, the gateway log files are stored in the following location:

```
C:\Users\<User>\.keeper\logs\
```

#### **Verbose Logging**

To activate verbose logging:

* Go to Windows Services > Keeper Gateway > Properties
* Stop the service
* Set the "Start parameters" to: `--debug` or `-d`
* Start the service by clicking on "Start"\
  \&#xNAN;*Do not click "OK" without first starting the service as it will not persist the Parameter setting*

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FNqfhdJpjRCJbgs6RfYjP%2Fimage.png?alt=media&#x26;token=88ee8691-e886-48b8-99ec-1e2ff1fe4f6c" alt="" width="303"><figcaption><p>Verbose Logging Mode</p></figcaption></figure>

### **Updating**

To update the Keeper Gateway, stop the service, install the latest version and then start the service.

* Run the latest Keeper Gateway installer
* During installation **DO NOT** select "Enter a Keeper One-Time Access Token".

<figure><img src="/files/3RGaqUPXu1ITSUuloCeg" alt=""><figcaption></figcaption></figure>

### **Auto Updates**

Select "Enable automatic updates" during the installer process to ensure that your Keeper Gateway is automatically updated when there are new versions available.

### **Health Checks**

To monitor the Gateway service, you can configure health checks that expose its operational status. These checks are useful for Docker orchestration, load balancing, and automated monitoring. See the [Health Check section](/keeperpam/privileged-access-manager/getting-started/gateways/health-checks.md) for full setup details and examples.

***

### Silent Install

This section provides instructions for performing a silent installation of the Keeper Gateway on Windows systems. Silent installation allows the setup process to run in the background without displaying any user interface or messages.

To install the Keeper Gateway silently, use the following command in your command prompt or script:

```
keeper-gateway_windows_x86_64.exe /verysilent /suppressmsgboxes /norestart /token=<TOKEN>
```

Replace `<TOKEN>` with the token provided in the Keeper Vault when creating the Keeper Gateway.

#### Configuration Options

If you have previously installed Keeper Gateway and wish to use the existing configuration, you can bypass the token entry by using:

```
/existingconfig=1
```

To generate a log file during the installation process, use the following option and specify the desired log file path:

```
/log=<Optional log file>
```

#### **Windows Service Account**

If you prefer to run the Keeper Gateway under a specific Windows service account, use the following options to specify the account details:

```
/mergetasks="service/account" /serviceuser=<ACCOUNT USERNAME> /servicepass=<ACCOUNT PASSWORD>
```

Replace `<ACCOUNT USERNAME>` and `<ACCOUNT PASSWORD>` with the credentials of the service account you intend to use.

#### **Auto Updater**

To enable the Auto Updater feature, allowing Keeper Gateway to automatically check for and apply updates, use the following option:

```
/autoupdate=1
```

### Uninstalling

To uninstall the service:

* Uninstall Keeper Gateway from "Add and remove programs"
* If desired, delete the private configuration .json file

### Network Requirements

The Keeper Gateway establishes outbound-only connections and does not require any inbound firewall rules. The following **outbound** connections must be allowed:

<table><thead><tr><th width="310.1015625">Destination Endpoint</th><th>Ports Needed</th><th>More Info</th></tr></thead><tbody><tr><td><p><strong>Keeper Cloud</strong><br><code>keepersecurity.[x]</code></p><p>Endpoints:</p><p>US: <code>.com</code></p><p>EU: <code>.eu</code></p><p>AU: <code>.com.au</code></p><p>JP: <code>.jp</code></p><p>CA: <code>.ca</code></p><p>US_GOV: <code>.us</code></p></td><td>TLS Port 443</td><td>Communicates with Keeper Cloud to access target infrastructure via native protocols (e.g., SSH, RDP)</td></tr><tr><td><p><strong>Keeper Router</strong><br><code>connect.keepersecurity.[x]</code></p><p>Endpoints:</p><p>US: <code>.com</code></p><p>EU: <code>.eu</code></p><p>AU: <code>.com.au</code></p><p>JP: <code>.jp</code></p><p>CA: <code>.ca</code></p><p>US_GOV: <code>.us</code></p></td><td>TLS Port 443</td><td>Communicates with Keeper Router to establish secure, real-time WebSocket connections</td></tr><tr><td><p><strong>Keeper Stun/Turn Service</strong></p><p><code>krelay.keepersecurity.[x]</code></p><p>Endpoints:</p><p>US: <code>.com</code></p><p>EU: <code>.eu</code></p><p>AU: <code>.com.au</code></p><p>JP: <code>.jp</code></p><p>CA: <code>.ca</code></p><p>US_GOV: <code>.us</code></p></td><td>TCP and UDP opened on Port 3478<br><br>Outbound access to TCP and UDP ports 49152 through 65535<br></td><td>Facilitates secure and encrypted WebRTC connections between end-user's vault and target systems via the Gateway</td></tr></tbody></table>

The Gateway preserves zero knowledge by performing all encryption and decryption of data locally. Keeper Secrets Manager APIs are used to communicate with the Keeper cloud.

### Checksum Verification

Keeper Gateway SHA256 hashes for the latest version are published at the below location:

<https://keepersecurity.com/pam/latest.txt>

Calculating and verifying the checksum:

#### Linux

```
sha256sum keeper-gateway_linux_x86_64
cat keeper-gateway_X.X.X_SHA256SUMS | grep keeper-gateway_linux_x86_64
```

#### PowerShell

{% code overflow="wrap" %}

```
Get-FileHash -Algorithm SHA256 keeper-gateway_windows_x86_64.exe | Format-List
Get-Content keeper-gateway_X.X.X_SHA256SUMS | Select-String keeper-gateway_windows_x86_64.exe
```

{% endcode %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/privileged-access-manager/getting-started/gateways/windows-installation.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.