> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/release-notes/enterprise/endpoint-privilege-manager/endpoint-privilege-manager-2.1.md). # Endpoint Privilege Manager 2.1 Release 2.1 broadens Keeper EPM's agentic-AI coverage, strengthens the macOS System Extension and the Linux agent, adds macOS MDM deployment, and delivers a wide set of improvements across Windows, macOS, and Linux.
### New Features * **Configurable Elevation Wait Overlay** — the elevation wait UI supports configurable messaging and a distinct failure-display path, giving administrators clearer control over the end-user experience during elevation. * **Agent-Side Machine-Check Policy Enforcement** — policies can enforce machine-scoped checks directly on the agent, reducing round-trips and enabling stricter local evaluation. * **Linux Non-Elevated Command Line and Controls** — Linux endpoints gain non-elevated command-line coverage and associated controls, extending parity with Windows and macOS. * **Expanded Agentic-AI Detection** — detection rules cover additional cloud agents (Grok, GitHub Copilot, and Microsoft 365 Copilot) and the VS Code Claude plugin (`bun.exe`). * **macOS MDM Install Support** — a packaged installer with a paired Full Disk Access configuration profile enables silent, MDM-managed deployment of Keeper EPM. * **Billing-Grade Audit Events for Agentic Access and Agentic Privilege Elevation** — new audit tracking events support billing and utilization reporting, and audit timestamps include millisecond precision.
### Enhancements * **Cisco VPN Exclusions** added to the default exclusion set. * **`dsa-wrs-app.exe` added to `exclude.dat`**, streamlining evaluation. * **Default Local Port Changed** to remain compatible alongside Acronis, with documentation updated to match. * **Application Collection Matching** — collection members can be matched by hash only, path only, or path + hash (AND), giving administrators finer control over Application collections. * **Azure and Entra Group Import** — group-import jobs handle a wider range of directory shapes and error conditions during synchronization. * **Pre-Inventory Warmup for Known AI Agents** — Keeper EPM primes agent metadata at startup so the first Agentic AI launch delivers instant response.
* **Policies Cleared on Unregister** — unregistering an endpoint clears its policy cache, keeping endpoint state clean after removal from the console. * **JSON Parsing Hardened** — configuration and policy JSON parsing tolerates a broader range of character-code inputs. ### Security * **Hardened AI-Agent Ancestor Detection** — agentic privilege elevation validates process identity using PE VersionInfo and trusted Authenticode identity, resolving a Bugcrowd-reported local privilege escalation vector. * **Trusted Signing / Short-Lived Certificate Handling** — agentic-AI identity verification recognizes timestamped and short-lived Trusted Signing certificates, keeping legitimately signed processes properly identified across their full validity window. * **Elevation Tokens Redacted from Logs** — elevation tokens are stripped from log output, hardening log-collection workflows against sensitive-data exposure. * **CURL Updated to 8.21.1** — incorporates upstream fixes for high-severity CVEs in the bundled CURL dependency. ### Improvements #### Windows * S**igned-Binary Validation via `WinVerifyTrust`** performs reliably across the certificate trust chain. * Startup resilience: `KeeperClient` launch retry and Backend/API retry coordinate with network readiness, delivering smoother boot-time initialization. * **`KeeperUserSession` Ephemeral-Profile Cleanup** handles in-use `NTUser.Dat` files gracefully, delivering a stable removal path with reduced startup and runtime cost. * **Logon-Time Job and Plugin** execution is coordinated by boot phase, delivering a smoother, more responsive sign-in experience. * **Windows Hook-Side Optimizations** lower policy-evaluation load during high-concurrency events, improving overall responsiveness. * **TCP Table Lookups** remain reliable under burst-load conditions. * **FileAccess Wildcard Paths** resolve relative to the binary directory, so leading-wildcard patterns match as authored. * Agent UI presents a streamlined **Register | Exit** menu once an endpoint has been unregistered. * **Windows 11 Endpoint Registration State** clears cleanly when `KeeperUnregistraterHelper` is run as administrator and the endpoint is removed from console. * **Progress Indicator on Windows** dismisses cleanly on fast application launches. * **`KeeperApproval` submits reliably when rapid agentic-AI launches spawn concurrent approval dialogs.** * **Port Number Changes** in `appsettings.json` propagate to every plugin. * **Privilege Elevation with Justification:** the justification prompt appears reliably on the first attempt. * **Agentic AI Auto-Update via ShipIt** completes cleanly during privilege elevation. * **Detached Subprocesses** such as `chrome_crashpad_handler` are traced back to their originating parent application, even when the intermediate process has exited. * **MFA Resubmit and Retry** completes end-to-end in a single flow. * **More specific policies take precedence over wildcard subprocess rules.** * **FileAccess Hook** skips evaluation for event types with no defined policies, reducing per-launch overhead. * **Performance Improvement** when launching or elevating files from user-profile directories. * Every **Agentic AI request Carries a Matching Activity Correlation UID** across its audit events. * **Consecutive Calls** to the same agentic-access app are consistently classified and logged as agentic access. * **Agentic Grants are Reused** across Agentic AI subprocess executables in the same session, delivering a single-approval experience for multi-process agents. * **FA ACL Enforcement** honors all-users policies via `UserCheck "*"`, preserving the Users and Total Restrictions counts. * **Agentic Access Monitor / MonitorAndNotify** preserves subprocess attribution when no Enabled AgenticAccess policy exists, keeping agentic audit and Console notifications intact. * **Enriched `OpenProcessToken` Audit Events** include the process PID and name when both are available. * **File-Access Attempts** made before endpoint registration completes return a clear, actionable diagnostic. * **Audit Event Stream** is streamlined by removing redundant `subprocess_*` records and expanded with `policy_evaluation_status` events for FileAccess in every evaluation path, giving reviewers a complete trail. #### macOS * **System Extension Resilience**: * Reliable operation of `keeper_auth_event` through display-wake cycles. * Cold-boot startup uses non-blocking user resolution, keeping the extension registered with EndpointSecurity from the first boot cycle. * A watchdog automatically restores the extension's MQTT connection to `KeeperPrivilegeManager`, keeping policy delivery uninterrupted. * UID-to-username resolution completes promptly under enterprise directory configurations, keeping the System Extension and `KeeperPolicy` stable. * **Request Elevated** launches GUI applications, non-GUI (terminal) applications, and DMG installers with the intended admin/root privileges. * **Wildcard FileAccess Policy Scopes** precisely to executable binaries when applied via `KeeperClient`. * **AgenticAI policies Apply Consistently** to nested `.app` bundle helpers launched by an approved agent. * **Agentic AI Justification and MFA Grants** complete in a single prompt, and the target application launches on the first attempt. * **`TaskExecutor`** R**eleases Pipe** handles cleanly on process timeout, improving long-running stability and audit signal quality. * **Policy Evaluation on macOS** handles cross-platform policy sets containing Windows-specific path variables cleanly. * **macOS audit events** include deduplicated, stamped process ancestry across Agentic AI chains (Cursor, Claude, and shell wrappers). * **macOS Auto-Update Installs the new System Extension** build even when the previous build is `[activated enabled]`, ensuring endpoints track the latest release. * **MDM Full Disk Access Profile** applies to `KeeperPrivilegeManager.app` automatically, enabling zero-touch enterprise deployment. * **DMG/PKG Elevation** surfaces a specific, actionable error with resolution steps when Full Disk Access is missing. #### Linux * **Kill-on-Deny** precisely targets the offending wrapper script, preserving surrounding applications such as Firefox and VS Code. * **`KeeperLinuxAgent`** produces concise syslog output for system-UID auto-allow decisions, matching the format used by the other plugins. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.keeper.io/release-notes/enterprise/endpoint-privilege-manager/endpoint-privilege-manager-2.1.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.