> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/architecture/configuration-settings.md). # Configuration Settings ## Keeper EPM Configuration Settings Reference This document is the complete configuration-settings reference for the Keeper Endpoint Privilege Manager (EPM) agent. It lists every setting the agent reads, organized by functional area. Each entry shows the setting's key, default value, a description of what it controls, and any notes an administrator should know before touching it. #### Contents (250 total) * [Agentic / Intel (13)](#agentic-intel) * [Boot & Performance (6)](#boot-and-performance) * [Client UI (18)](#client-ui) * [Cloud & API (10)](#cloud-and-api) * [Deploy / MDM (3)](#deploy-mdm) * [Environment Variables & Platform Detection (6)](#environment-variables-and-platform-detection) * [Internal Architecture (5)](#internal-architecture) * [Inventory (17)](#inventory) * [Job Orchestration, Automation & PAM (2)](#job-orchestration-automation-and-pam) * [Linux Agent (12)](#linux-agent) * [Localization (2)](#localization) * [Logger (10)](#logger) * [Logging & Monitoring (11)](#logging-and-monitoring) * [macOS System Extension (14)](#macos-system-extension) * [MFA & Execution Grants (8)](#mfa-and-execution-grants) * [Path Protection (6)](#path-protection) * [Path Variables (1)](#path-variables) * [Plugin Bootstrap & Shared Wiring (2)](#plugin-bootstrap-and-shared-wiring) * [Policy Engine (24)](/en/keeperpam/endpoint-privilege-manager/policies.md) * [Redirect (5)](#redirect) * [Research / Non-Production Tooling (2)](#research-non-production-tooling) * [Security & Trust (20)](#security-and-trust) * [Service, Network & Messaging (35)](#service-network-and-messaging) * [Session & Watchdog (15)](#session-and-watchdog) * [Storage (2)](#storage) * [Windows Injector (1)](#windows-injector) *** ### Agentic / Intel
SettingDescriptionNotes
Settings: agent-application-inventory.json
Default: generated mirror		Runtime application-inventory mirror used by agentic and vulnerability policiesGenerated state; document lifecycle and retention separately from the source catalog.

Settings: AiLikelihoodCapSettings.json / AiLikelihoodFloorSettings.json

Default: basename and identity lists

AI-agent risk-score caps and floorsDetection-data content.

Settings: Config\AiLikelihood*.json per-binary copies

Default: same as canonical Agentic/Intel files

Per-binary copies of shared AI-detection configurationGenerated install-tree copies; edit canonical content only.

Settings: intel-deploy-manifest.json

Default: installer-defined

Deployment manifest for Intel contentInstaller-owned metadata; do not edit directly.

Settings: intel/app-catalog.ndjson(.gz)

Default: (via KeeperApi refresh)

Current vulnerability/product catalog sourceAuthoritative product/CVE catalog for vulnerability baselines.

Settings: intel/normalized-vulnerability.jsonl

Default: (feed present on install)

Legacy CVE feedSuperseded by app-catalog.ndjson(.gz); still shipped for compatibility.

Settings: intel/rules/AI_Detection.json / Risk_Behavior.json / Vulnerability.json

Default: rule content

Detection and risk-assessment rulesRule-engine content.

Settings: KeeperAgenticSnapshotWriter.metadata.hostProcess

Default: KeeperPrivilegeManager

Expected host process nameDo not edit. Security/identity expectation for the writer; must stay product-fixed.

Settings: KeeperAgenticSnapshotWriter.metadata.taskDelay

Default: 250

Writer loop delayInternal pacing, not a risk-policy control.

Settings: KeeperAgenticSnapshotWriter manifest bootstrap

Default: paths/priority/autoStart

How the Rust snapshot writer is launchedDo not edit. Installer-owned; the intel/rules content above is the supported admin surface.

Settings: SchemaVersion field (inside AiLikelihood/SystemShell/ShellMediatedParent/AgenticChainIntermediary content files)

Default: 1–3 depending on file

Internal format-versioning fieldBookkeeping for forward-compatible parsing; not a tenant-editable value.

Settings: static-scan-product-haystack.json

Default: scoreBuckets (embedded)

Static-scan product haystack buckets for AI scoringUpdating patterns improves detection without agent rebuilds.

Settings: SystemShellBasenames.json / ShellMediatedParentBasenames.json / AgenticChainIntermediaryBasenames.json

Default: basename lists

Basenames used for AI-agent attributionDetection-data content.
### Boot & Performance | Setting | Default | Description | Notes | | -------------------------------------------------------------- | ------- | ------------------------------------------- | ------------------------------------------------------------------ | | `Settings:BootPhase:DeferNonCriticalJobsAfterBootMinutes` | 3 | Post-boot grace window (minutes) | Prevents inventory/updater contention with logon scripts. | | `Settings:BootPhase:DeferNonCriticalJobsAfterLogonMinutes` | 2 | Post-logon grace window (minutes) | Per-user logon grace for multi-session hosts. | | `Settings:BootPhase:DeferPolicyPathObservedDuringGrace` | true | Buffer inventory/path triggers during grace | Prevents queuing dozens of scans during logon storms. | | `Settings:BootPhase:Enabled` | true | Defer non-critical jobs after boot/logon | Protects login-time UX by deferring heavy jobs during boot storms. | | `Settings:BootPhase:KeeperUpdaterLogonDeferralSeconds` | 90 | Updater deferral after logon (seconds) | Stops updater I/O from colliding with first-login installs. | | `Settings:BootPhase:MaxConcurrentExternalProcessesDuringGrace` | 3 | Max external job processes during grace | Caps job fan-out to protect CPU/disk on thin clients. | ### Client UI | Setting | Default | Description | Notes | | ----------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | `elevation-allowed-extensions.json` | windows: .exe/.bat/.cmd/.msi/.ps1 | Allowed Request Elevation file types per OS | Wrong list blocks `.msi`/`.ps1` requests or opens risky file types. | | `keeperAgent.executionContext` / `KeeperClient` and `keeperAgent` bootstrap fields | User / various | UI-host process lifecycle and security context | Do not edit. These define the security boundary each UI process runs under. | | `keeperAgent.metadata.approvalExpirationHours` | 72 | Hours until a pending approval expires | Prevents approval queues from growing stale. | | `keeperAgent.metadata.approvedRequestExpirationHours` | 24 | Hours until an approved grant can no longer launch | Shorter TTL reduces lingering privilege. | | `keeperAgent.metadata.historyRetentionDays` | 30 | Local request-history retention | Balances self-service value against privacy/disk limits. | | `keeperAgent.metadata.maxExceptionMessageLength` | 500 | UI exception-message truncation length | Cosmetic UI limit, not a security or policy setting. | | `keeperAgent.metadata.maxHistoryItems` | 20 | Max history items shown in the UI | Bounds rendering cost on busy approvers' machines. | | `keeperAgent.metadata.maxPayloadSizeBytes` | 1048576 | Max MQTT payload size the agent UI accepts | Raise if request/approval payloads legitimately need to be larger. | | `keeperAgent.metadata.maxRequestItems` | 20 | Max pending requests shown in the UI | Prevents huge pending queues from freezing the dialog. | | `keeperAgent.metadata.mqttTopics` / `mqttRole` / `uiComponent` / `requiresDisplay` | UI host flags + topics | Agent UI MQTT wiring and host flags | Do not edit. Same bootstrap-plumbing concern as KeeperClient. | | `keeperAgent.metadata.showInTray` | false | Show the keeperAgent tray icon | Separate tray presence from KeeperClient. | | `KeeperClient.metadata.LanguageOverride` | DEFAULT | UI language override | Forces UI locale independent of OS language. | | `KeeperClient.metadata.menu.autoRefresh` | true | Auto-refresh the tray menu on a timer | Disable to stop timer churn on locked-down thin clients. | | `KeeperClient.metadata.menu.items` | product menu | Tray menu jobs, dialogs, and visibility filters | Customizes which request/approval jobs appear in the tray. | | `KeeperClient.metadata.menu.refreshIntervalMinutes` | 5 | Tray menu refresh interval | Tune for VDI density vs. API load. | | `KeeperClient.metadata.mqttTopics` / `mqttRole` / `uiComponent` / `requiresDisplay` | UI host flags + topics | Client MQTT wiring and UI host flags | Do not edit. Tray/language/menu settings above are the supported controls; the underlying MQTT/UI-host flags are bootstrap plumbing. | | `KeeperClient.metadata.showInTray` | true | Show the KeeperClient system tray icon | Some kiosks hide tray icons; interactive desktops usually require them. | | `KeeperClient.metadata.toastIcon.windows` | Assets/kepm-toast.png | Toast-notification icon path for Windows | Cosmetic branding asset path; editing it does not change behavior. | ### Cloud & API | Setting | Default | Description | Notes | | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- | --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | `KeeperApi.metadata.approval.useNewTypes` | true | Use the new approval-type mapping for agentic policies | Feature flag during rollout of new policy schemas. | | `KeeperApi.metadata.category` | Keeper API | UI category label | Cosmetic label only. | | `KeeperApi.metadata.cveCatalog.refreshHours` | 6 | CVE catalog refresh interval (hours) | Air-gapped/bandwidth-limited sites may need longer intervals. | | `KeeperApi.metadata.cveCatalog.subfolder` | AgenticIntel | Subfolder name under the data directory for CVE intel | Folder naming is product layout; the refresh interval above is the tunable setting. | | `KeeperApi.metadata.maxJustificationTextLength` | 512 | Max justification text synced with the cloud | Must match ticket systems and the Controls limit. | | `KeeperApi.metadata.mqttTopics.publish` / `.subscribe` | topic lists | Publish/subscribe topics for the cloud-bridge plugin | Do not edit. Same MQTT-role-graph risk as above. | | `KeeperApi.metadata.mqttTopics` / `mqttRole` | cloud bridge topics | KeeperApi MQTT topology | Do not edit. Cloud-bridge wiring; edits can disconnect the agent from the Keeper backend. | | `KeeperApi.metadata.transactionTracking` | true | Track cloud transaction state for API calls | Enables cloud transaction correlation for support/audit. | | `KeeperApi.requiredPermissions` / `startupPriority` / `.autoStart` / `.requiresMonitoring` / `.autoRestart` / `Subscription.Topic` / `.Qos` / `.CleanSession` | various | Core backend-communication plugin bootstrap and lifecycle | Do not edit. This plugin is started early and monitored by design; reordering or disabling monitoring can break cloud connectivity. | | `ROUTER_URL` (environment variable) | (unset) | Environment override for the Keeper cloud router URL | For air-gapped or private Keeper router deployments. | ### Deploy / MDM | Setting | Default | Description | Notes | | ----------------------------------------------- | -------------------- | ----------------------------------------------------------------- | ----------------------------------------------------------------------------- | | Full Disk Access (`SystemPolicyAllFiles`) | KEPM paths | Full Disk Access grants for the KEPM launcher/daemon/notify/trash | Mandatory for reliable process/file visibility on macOS. | | `KEEPERREGCODE` | (MDM-supplied) | macOS managed preference for the agent registration code | Device join secret; must be pushed via MDM, not left unset. | | System Extension allowlist (Team ID 234QNB7GCA) | com.keeper...monitor | Allows the Endpoint Security system extension via MDM | Without allowlisting, macOS blocks the extension and monitoring never starts. | ### Environment Variables & Platform Detection | Setting | Default | Description | Notes | | ----------------------------------------------------------- | -------------------- | --------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | `HARDWARE_UUID` | environment-provided | Hardware identity input used by the agent | Device identity input. | | `KEEPER_EXECUTION_ID` | unset | Host-injected per-execution correlation ID | Same as above — correlation plumbing for logging/tracing. | | `KEEPER_INSTALL_LAUNCHER_SILENT` | unset/falsy | Suppresses the installer launcher's stderr failure summary | Debug/console convenience flag only; does not change installer behavior or exit code. | | `KEEPER_JOB_ID` | unset | Host-injected job correlation ID for a spawned job process | Bootstrap plumbing; injected automatically, not something an admin sets. | | `KEEPER_MQTT_PORT` | 8883 (fallback) | Overrides the MQTT broker port used by standalone job/example clients | Do not set this to change broker behavior. Use the `MqttBrokerSettings:Port` setting above; this variable only affects narrow example/job tooling. | | `PATH` / `HOME` / `USER` / `DISPLAY` / `SUDO_USER` / `LANG` | OS-provided | Standard OS environment variables the agent reads incidentally | Not application settings — these are the operating system's own environment and should be managed at the OS level, not through Keeper. | ### Internal Architecture Internal process, manifest, and tooling groups used by the product. | Setting | Default | Description | Notes | | --------------------------------------------- | ------------------ | -------------------------------------------------------------------------------------- | -------------------------------------------------- | | Duplicate configuration copies | mirrored values | Storage, justification, and install-tree mirrors of canonical settings | Redundant configuration copies. | | Job orchestration, automation, and PAM wiring | product job graphs | Job graphs, service bridges, elevation-chain ordering, and launcher parameters | Job lifecycle configuration. | | Localization internals | translation data | `SharedLocales`, `LocaleValues`, and `locale-cache-cleanup.json` | Localization pipeline data. | | Plugin manifest bootstrap and MQTT wiring | product manifests | Plugin identity, startup priority, execution context, subscriptions, topics, and roles | Process bootstrap configuration. | | Research and non-production tooling | product prototypes | ControlPlane research prototype and `intel-fetch-tool` pipeline | Development tooling, not production configuration. | ### Inventory
SettingDefaultDescriptionNotes
BatchSize / CheckpointFrequency / MaxDirectoryQueueSize / MaxFilesPerDirectory / FileOperationTimeoutSeconds50 / 500 / 10000 / 10000 / 30Scan-engine batching, checkpointing, queue-size, and timeout internalsImplementation-detail tuning for the scan loop; misconfiguring risks stalls or resource exhaustion.
EnableIncrementalScan / EnableProgressReporting / EnableSecurityValidation / EnableDynamicSystemExclusions / EnableExecutableExtensionFilter / EnableExecutablePermissionCheck / EnableExecutableMagicNumberDetection / EnableNonExecutableDirectorySkipping / EnableExecutableDirectoryPrioritizationtrue (most) / false (two)Detection-algorithm toggles for how the scanner identifies executablesDo not edit. Disabling any of these silently degrades scan accuracy/coverage — e.g. skipping magic-number or security validation.
Inventory plugin manifests (KeeperInventoryFull / Basic / Incremental / User)MQTT + bootstrapInventory plugin launch manifestsDo not edit. Scan behavior is controlled by the settings above; these manifests only control how the scan binaries are launched.
InventoryFull.EnableExecutableOnlyScanningtrueLimit scan to executable/package typesFocuses inventory value vs. whole-disk crawl cost.
InventoryFull.EnableHashCachingtrueCache file hashes between runsSpeeds incremental-ish full runs.
InventoryFull.ExcludeDevelopmentDirectoriesfalseExclude development tool directoriesKeeps fleet scans tractable on dev workstations.
InventoryFull.ExcludePathscross-platform listPaths excluded from full inventory scanSkipping large trees (WinSxS, node_modules) is required to finish scans.
InventoryFull.ExcludeUserSpecificDirectoriesfalseExclude per-user directories from the scanPrivacy/performance option for shared kiosks.
InventoryFull.ExcludeVirtualizationDirectoriestrueExclude VM/container directoriesPrevents container/VM images from exploding scan time.
InventoryFull.HashCacheValidityDays7Hash cache validity windowStaleness window for cached hashes vs. rescan cost.
InventoryFull.MaxConcurrentFiles3Parallel file-processing limitTune for SSD vs. spinning disk or AV-contention hosts.
InventoryFull.MaxDirectoryDepth20Maximum directory recursion depthStops pathological deep trees from hanging the job.
InventoryFull.MaxFileSizeBytes500000000Skip files larger than this sizeSkips huge blobs that burn hash time without security value.
InventoryFull.MaxMemoryUsageBytes268435456Memory budget for the inventory processPrevents OOM-killing thin VDI agents.
InventoryFull.MinDaysBetweenRuns3Minimum days between full inventory scansFull scans are expensive; cadence must match endpoint capacity.
InventoryFull.PriorityExtensionsexe/script/packageFile extensions prioritized during scanEnsures high-value extensions are scanned first when time-budgeted.
InventoryFull.ThrottleDelayMs25Throttle delay between file operationsYields for AV-friendly scanning on contended endpoints.
### Job Orchestration, Automation & PAM Job, PAM, and elevation-chain lifecycle configuration. | Setting | Default | Description | Notes | | --------------------------------------------- | ------------------ | ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- | | Job orchestration, automation, and PAM wiring | product job graphs | Job graphs, service bridges, elevation ordering, and launcher parameters | Internal/runtime configuration; do not edit without source-supported overrides. | | `JobStoreOptions.AllowedStorePathRoot` | product data root | Safety boundary for persisted job-store paths | Validate before exposing; may be an internal path constraint rather than a relocation setting. | ### Linux Agent | Setting | Default | Description | Notes | | ------------------------------------------------------------------------------------------ | ----------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------------------- | | `KeeperLinuxAgent.metadata.commandLine.allowPaths` / `.fileAccess.allowPaths` | product path lists | Linux monitoring path exclusions | Platform monitoring path configuration. | | `KeeperLinuxAgent.metadata.fileAccess.uidThreshold` / `.commandLine.uidThreshold` | 1000 | Linux UID threshold for file and command monitoring | Linux monitoring threshold. | | `KeeperLinuxAgent.metadata.mqttOutages.connectionFailureBehavior` | `allow` | Behavior when the local broker is unreachable | Agent outage behavior. | | `KeeperLinuxAgent.metadata.mqttOutages.retries.minDelay` / `.maxDelay` | 1–20s | MQTT outage retry interval bounds | Connectivity retry tuning. | | `KeeperLinuxAgent.metadata.mqttTopics.publish` / `.subscribe` | topic lists | MQTT wiring for the Linux agent | Do not edit. Editing this can silently break Linux policy enforcement. | | `KeeperLinuxAgent.metadata.policy.cache.cleanupInterval` | 30 | Decision cache cleanup interval | Tune under memory pressure. | | `KeeperLinuxAgent.metadata.policy.cache.expireAfter` | 60 | Decision cache TTL (seconds) | Balances freshness vs. performance. | | `KeeperLinuxAgent.metadata.policy.maxResponseTimeout` | 5.0 | Max wait for a policy decision (seconds) | Raise for slow disks/directory lookups. | | `KeeperLinuxAgent.metadata.policy.onPolicyTimeout` | `allow` | Behavior when policy evaluation times out | Policy timeout behavior. | | `KeeperLinuxAgent.metadata.policy.sessionInfrastructureProcesses` | gnome-shell, plasmashell, ... | Desktop-infrastructure processes excluded from heavy policy | Prevents over-policing desktop compositors. | | `KeeperLinuxAgent.metadata.policy.sessionShellProcesses` | bash, sh, zsh, ... | Shell processes treated as session infrastructure | Customize per org's default shells. | | `KeeperLinuxAgent.startupPriority` / `.autoStart` / `.requiresMonitoring` / `.autoRestart` | 80 / true / true / true | Linux fanotify agent lifecycle | Do not edit. Boot ordering for this kernel-level intercept is carefully chosen. | ### Localization Localization data and cache maintenance. | Setting | Default | Description | Notes | | -------------------------------- | ------------------------ | ----------------------------------- | ------------------------------------------------------- | | `locale-cache-cleanup.json` | installer-defined | Localization cache cleanup metadata | Installer/runtime-owned file. | | `SharedLocales` / `LocaleValues` | product translation data | Shared localization resources | Internal runtime data; not a customer-editable setting. | ### Logger | Setting | Default | Description | Notes | | ---------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | | `KeeperLogger.metadata.logFileName` | Log/KeeperLogger.log | Log file path | Redirect logs to approved paths for ACL and collection agents. | | `KeeperLogger.metadata.loggingHttpEndpoint` | "" | Remote HTTP log sink URL | Target for remote log forwarding when enabled. | | `KeeperLogger.metadata.logRetentionDays` | 15 | Days to keep rotated logs | Must match legal hold / SIEM ingest SLAs. | | `KeeperLogger.metadata.logToFile` | true | Write aggregated logs to disk | Required for offline forensics on locked-down images. | | `KeeperLogger.metadata.logToHttpEndpoint` | false | Forward logs to an HTTP sink | Ship logs to a tenant HTTP collector without a separate forwarder. | | `KeeperLogger.metadata.maxFileSizeMB` | 100 | Log rotation size (MB) | Affects disk usage and log history depth. | | `KeeperLogger.metadata.mqttRole` / `mqttTopics` | subscriber | Logger MQTT wiring | Do not edit. Topology only — the actual sink settings are listed above. | | `KeeperLogger.metadata.taskDelay` | 250 | MQTT loop delay (ms) | Internal pacing/micro-tuning; changing it fleet-wide risks message backlog with no clear benefit. | | `KeeperUSession.metadata.logToFile` / `logFileName` / `maxFileSizeMB` / `logRetentionDays` / `logToHttpEndpoint` / `loggingHttpEndpoint` | logger-like defaults | Legacy logging block on the USession component | Do not edit. Duplicates the Logger settings above; editing both creates split-brain logging. Use the Logger settings instead. | | `KeeperUSession.metadata.taskDelay` | 250 | USession MQTT loop delay | Same micro-tuning concern as the Logger's `taskDelay`. | ### Logging & Monitoring | Setting | Default | Description | Notes | | ------------------------------------------------------ | ----------- | ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `KeeperPolicy.metadata.processTreeDebug.logToEventLog` | false | Enables very-high-volume process-ancestry debug logging | Debug-only. Floods the Event Log; enable only for a live troubleshooting session under Keeper support guidance, then disable it again. | | `KeeperSystemLogging:DebugFilteredMessages` | false | Verbose diagnostics for filtered system-log messages | Shows what the system logger dropped; used for SIEM filter tuning. | | `KeeperSystemLogging:EnableInfoFallback` | true | Fallback Info-level logging when KeeperLogger is down | Preserves audit breadcrumbs during outages. | | `KeeperSystemLogging:MinimumSystemLogLevel` | Information | Floor for OS system-log entries | Filters OS-log volume vs. security-event fidelity. | | `KeeperSystemLogging:PluginCheckIntervalMinutes` | 5 | How often Logger plugin health is verified | Lower to detect silent log loss faster. | | `KeeperSystemLogging:SystemLoggingEnabled` | true | Master switch for OS event-log / syslog output | Required by many SIEM/compliance pipelines. | | `Logging:LogLevel:Default` | Information | ASP.NET framework default log level | Useful when Kestrel/auth middleware issues must be captured. | | `PluginMonitoring:CheckIntervalMinutes` | 0.5 | Plugin process health-check cadence | Availability vs. CPU tradeoff for crash detection. | | `PluginMonitoring:Enabled` | true | Master switch for plugin process health monitoring | Disables fleet-wide health monitoring when off. | | `PluginMonitoring:LogHealthChecks` | false | Log every plugin health-check result | Verbose health spam for short-lived diagnosis of restart loops. | | `Settings:system.logging.level` | Warning | Main service log level shorthand | Primary troubleshooting lever; escalate to Debug fleet-wide without remote access. | ### macOS System Extension | Setting | Default | Description | Notes | | ---------------------------------------------------------------------------- | ------------------------ | --------------------------------------------------- | ----------------------------------------------------------------------------------------------- | | `SystemExtension.autoStart` / `.requiresMonitoring` / `.autoRestart` | false / false / false | Extension lifecycle flags | Do not edit. This is loaded by the macOS system-extension framework, not KPM-managed lifecycle. | | `SystemExtension.metadata.commandLine.allowPaths` / `.fileAccess.allowPaths` | product path lists | macOS monitoring path exclusions | Platform monitoring path configuration. | | `SystemExtension.metadata.mqttOutages.connectionFailureBehavior` | `allow` | Behavior when the local broker is unreachable | Agent outage behavior. | | `SystemExtension.metadata.mqttOutages.retries.minDelay` / `.maxDelay` | 1–20s | MQTT outage retry interval bounds | Connectivity retry tuning. | | `SystemExtension.metadata.mqttTopics.publish` / `.subscribe` | topic lists | MQTT wiring for the System Extension | Do not edit. Editing this can silently break macOS Endpoint Security enforcement. | | `SystemExtension.metadata.policy.cache.cleanupInterval` | 30 | Decision cache cleanup interval | Tune under memory pressure; same rationale as the Linux Agent's equivalent setting. | | `SystemExtension.metadata.policy.cache.expireAfter` | 60 | Decision cache TTL (seconds) | Performance vs. freshness for macOS ES decisions. | | `SystemExtension.metadata.policy.highLoad.fallbackAllowPaths` | product path list | Paths used by high-load policy handling | System Extension fallback path configuration. | | `SystemExtension.metadata.policy.highLoad.inflightThreshold` | 200 | In-flight event threshold for high-load handling | System Extension load threshold. | | `SystemExtension.metadata.policy.maxResponseTimeout` | 5.0 | Max wait for a policy decision (seconds) | FDA-denied lookups may need longer timeouts. | | `SystemExtension.metadata.policy.onPolicyTimeout` | `allow` | Behavior when policy evaluation times out | Policy timeout behavior. | | `SystemExtension.metadata.privilegeElevation.allowPaths` | loginwindow, Keeper, ... | Privilege-elevation allow paths | Lets loginwindow/authtrampoline elevate without false policy hits. | | `SystemExtension.metadata.transaction.enabletracking` | false | Enable transaction tracking in the System Extension | Optional correlation for macOS ES debugging/audit. | | `SystemExtension.supportedPlatforms` | `["macOS"]` | Platform filter for this extension | Build/installer platform-filtering concern; console toggles won't add missing binaries. | ### MFA & Execution Grants | Setting | Default | Description | Notes | | ------------------------------------------------------ | ------------------------------------------------------------------ | ------------------------------------------------------ | ----------------------------------------------------------------- | | `Controls:maxJustificationTextLength` | 512 | Max characters in justification control text | Caps justification payload size; aligns with ticket-field limits. | | `ExecutionGrant:DefaultDurationMinutes` | 240 | Default execution grant lifetime (minutes) | Default JIT grant lifetime for approved elevations. | | `ExecutionGrant:MaxDurationMinutes` | 10080 | Maximum execution grant lifetime (7 days) | Hard ceiling so policies cannot issue week-plus grants. | | `KeeperRunElevated.metadata.apiEndpoints` | `GET /api/elevation/pending/{token}`; `POST /api/elevation/result` | Internal elevation-result API endpoints | Internal elevation protocol. | | `MfaGracePeriod:GracePeriodMinutes` | 5 | Skip MFA re-prompt window after a successful challenge | Balances productivity vs. session-hijack risk. | | `MfaLockout:LockoutDurationMinutes` | 15 | MFA lockout duration after maximum failures | Balances lockout pain vs. attacker retry windows. | | `MfaLockout:MaxFailedAttempts` | 5 | Failed MFA attempts before lockout | Sets brute-force resistance for MFA controls. | | `transaction.enabletracking` (system-level, Admin API) | legacy flag | Legacy transaction tracking switch | Compatibility flag. | ### Path Protection | Setting | Default | Description | Notes | | ------------------------------------- | --------------------- | ------------------------------------------------------------------------- | -------------------------------------------------------------- | | `LeastPrivilegeExclusions` | (policy/storage) | Accounts excluded from least-privilege enforcement | Protects break-glass accounts that must keep admin rights. | | `LinuxProtectedDirectories.json` | filesystem defaults | Linux fanotify/path exclusions for protected directories | Distro layouts differ; adjust for local integrity/noise needs. | | `PolicyProtectedDirectories.json` | (from ProtectedPaths) | Protected directories written from ProtectedPaths policies | Materialized output of enforced ProtectedPaths policies. | | `ProtectedPaths` (policy type) | (policy-driven) | Console policy type protecting paths from conflicting FileAccess policies | Primary admin path-protection UX. | | `UserProtectedDirectories.json` | (optional overlay) | Admin/local overlay of wildcard FileAccess protected directories | For site-specific sensitive trees beyond platform defaults. | | `{Platform}ProtectedDirectories.json` | OS defaults | Platform default protected directories | Baseline protected directories per platform. | ### Path Variables | Setting | Default | Description | Notes | | -------------------------------------------- | ------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------- | | Custom path variables (arbitrary name→value) | (none) | Admin-defined path placeholders via the PathVariables API | Built-in variables are read-only; custom ones let policies/jobs use org path aliases. | ### Plugin Bootstrap & Shared Wiring Installer-owned plugin metadata and inter-process wiring. | Setting | Default | Description | Notes | | ------------------------------------------------------------------- | ----------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- | | `KeeperPAM`, `KeeperUSession`, and `KeeperRunAs` bootstrap metadata | product manifests | PAM, session, and elevation-stage lifecycle metadata | Keep lifecycle and MQTT metadata read-only. | | Plugin manifest bootstrap and MQTT wiring | product manifests | Plugin identity, dependencies, startup priority, execution context, subscriptions, topics, and roles | Installer-owned/internal metadata; keep read-only unless a supported override exists. | ### Policy Engine | Setting | Default | Description | Notes | | -------------------------------------------------------------------------------------- | ----------------------------------------------- | --------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | `currentPolicies.json` | `Plugins\bin\KeeperPolicy\currentPolicies.json` | Live policy snapshot path | Runtime policy-state path. | | `KeeperPolicy.metadata.admin.enforce_policies_for_administrators` | true | When true, wildcard-user policies also apply to administrators | Core security posture — whether local admins bypass wildcard policies. | | `KeeperPolicy.metadata.agentApplicationInventory.maxAgeSeconds` | 86400 | Stale-inventory threshold for agentic/vulnerability gates | Tune for offline or slow-sync endpoints. | | `KeeperPolicy.metadata.agentApplicationInventory.path` | "" (env/platform default) | Override path for the agent-application-inventory mirror file | Same storage-relocation rationale as `RepositoryPath`/`SharedRepositoryPath`. | | `KeeperPolicy.metadata.agenticSnapshot.maxAgeSeconds` | 120 | Deprecated snapshot max age | Dead alongside the deprecated snapshot path above. | | `KeeperPolicy.metadata.agenticSnapshot.path` | "" | Deprecated telemetry snapshot path | Deprecated. Realtime writer now uses the inventory mirror; do not point this at a live path. | | `KeeperPolicy.metadata.agenticSnapshot.vulnerabilityRiskMaxContribution` | 3.0 | Max vulnerability risk contribution from the inventory mirror | Prevents vulnerability noise from dominating policy scores. | | `KeeperPolicy.metadata.eventTypeJobMapping` | product map | EventType → control-job ID mapping | Routes event types to control workflows. | | `KeeperPolicy.metadata.eventTypeJobMapping._defaultJobId` | default-policy-controls | Fallback control-workflow job when no EventType mapping matches | Sub-field of the `eventTypeJobMapping` setting listed above; the default fallback specifically is not separately editable. | | `KeeperPolicy.metadata.eventTypeJobMapping.mappings` | EventType→job-id map | Maps policy EventType → job ID for controls workflows | Sub-field of the `eventTypeJobMapping` setting listed above. | | `KeeperPolicy.metadata.eventTypeRiskJobMapping` | product map | EventType → risk-assessment job mapping | Chooses which risk job runs per event type. | | `KeeperPolicy.metadata.eventTypeRiskJobMapping._defaultJobId` | composite-risk-evaluation | Fallback risk-assessment job | Sub-field of the `eventTypeRiskJobMapping` setting listed above. | | `KeeperPolicy.metadata.eventTypeRiskJobMapping.mappings` | EventType→risk-job map | Maps policy EventType → risk-assessment job ID | Sub-field of the `eventTypeRiskJobMapping` setting listed above. | | `KeeperPolicy.metadata.execution_grant.default_duration_minutes` | 240 | Policy-level override for grant TTL | Independent of the host `ExecutionGrant` default for tighter JIT control. | | `KeeperPolicy.metadata.lookup.slowCallTimeoutSeconds` | 5 | macOS/Linux slow policy-lookup timeout | Raise when directory servers are slow. | | `KeeperPolicy.metadata.maxRetryAttempts` | 3 | Retries for failed policy operations | Resilience against transient MQTT/API failures. | | `KeeperPolicy.metadata.mqttTopics.subscribe` / `.publish` | `["RequestApproval"]` / 15-entry list | MQTT wiring for the policy engine | Do not edit. Editing the policy engine's MQTT role graph can break elevation/policy chains fleet-wide. | | `KeeperPolicy.metadata.processCatalog.path` | "" | Durable process-catalog path | Empty means in-memory only; this is deployment plumbing, not a tenant policy decision. | | `KeeperPolicy.metadata.processCatalog.retentionHours` | 24 | Cross-session process-catalog retention | Longer retention helps RDP/JIT attribution but grows disk use. | | `KeeperPolicy.metadata.riskscore.default_score` | 5.0 | Default risk score when assessment is unavailable | Sets allow/deny bias for incomplete risk data. | | `KeeperPolicy.metadata.riskscore.use_default_on_failure` | false | Use the default score vs. fail when a risk job errors | Security-critical fail-open vs. fail-closed switch. | | `KeeperPolicy.metadata.storage.sharedContainers` | PolicyRegistry, AgentApplicationInventory | Named shared storage container definitions | Do not edit. Renaming containers orphans encrypted data. | | `KeeperPolicy.metadata.taskDelay` | 250 | MQTT message loop delay (ms) | Advanced tuning when policy latency or CPU spikes appear. | | `KeeperPolicy.startupPriority` / `.autoStart` / `.requiresMonitoring` / `.autoRestart` | 15 / true / true / true | Core policy-engine service lifecycle | Do not edit. Boot ordering is carefully chosen; reordering can cause race conditions at startup. | ### Redirect | Setting | Default | Description | Notes | | ----------------------------------------------- | ------------------------------- | -------------------------------------------------------------- | --------------------------------------------------------------- | | `RedirectEvaluator.arguments` | `--baseurl {KeeperApiBaseUrl}` | Launch arguments passed to the evaluator process | Do not edit. Product launch contract for this process. | | `RedirectEvaluator.metadata.mqttTopics.publish` | `["KeeperLogger"]` | MQTT wiring (publish-only) | Do not edit. Bootstrap MQTT plumbing. | | `RedirectEvaluator.metadata.redirect.enabled` | true | Enable launch redirects during privilege elevation | Master switch for this security feature. | | `RedirectEvaluator.metadata.redirect.rules` | ncpa, Notepad, Terminal, MSI... | Redirect rules mapping elevation requests to safer substitutes | Core customization point for org-specific tools and installers. | | `RedirectEvaluator.metadata.redirect.rulesPath` | optional | Redirect-rule source path | Retained for compatibility where supported. | ### Research / Non-Production Tooling Development and research-only configuration excluded from supported production settings. | Setting | Default | Description | Notes | | -------------------------------------- | ----------------- | --------------------------------------------- | --------------------------------------------------------------- | | `CONTROLPLANE_*` environment variables | research defaults | ControlPlane research prototype configuration | Research-only; exclude from supported production configuration. | | `intel-fetch-tool` pipeline | product prototype | Research Intel acquisition tooling | Non-production tooling. | ### Security & Trust | Setting | Default | Description | Notes | | ---------------------------------------------------------------------- | ------------------------------------ | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | `allow.dat` / `exclude.dat` / `noautoinject.dat` | product-shipped contents | Process policy and inspection lists | Default process-list content. | | `ConfigurationLkg:Enabled` | true | Last-known-good reconciliation for policy-written configuration | Enables self-healing after a bad configuration push. | | `KeeperPAM.executablePath` | `/Library/Keeper/lib/pam_keeper.so` | PAM module path | Platform integration path. | | `KeeperRunAs.metadata.credentialHandling` | ephemeral-accounts | Credential strategy label | Descriptive product contract, not a selectable account model. | | `KeeperRunAs.metadata.elevationStage` | first | Marks the first stage of two-stage elevation | Do not edit. Hard-wired stage identity; changing it does not re-architect elevation, it only breaks diagnostics. | | `KeeperRunAs.metadata.features` / `securityLevel` / `launchesElevated` | product tags | Feature tags for the RunAs stage | Documentation metadata for tooling; no runtime effect. | | `KeeperRunAs.metadata.launches` | KeeperRunElevated | Downstream elevated executable name | Do not edit. Wrong target breaks all Windows elevations. | | `KeeperRunElevated.metadata.elevationProxy` | true | Marks the elevation-proxy role | Do not edit. Stage identity for the elevation proxy. | | `KeeperRunElevated.metadata.features` / `securityLevel` | product tags | Feature tags for the elevation proxy | Non-behavioral metadata. | | `KeeperRunElevated.metadata.requiresEphemeralCredentials` | true | Requires ephemeral admin credentials | Do not edit. Product security invariant; disabling is unsupported and weakens the elevation model. | | `Plugins:JobService:AgentInactiveJobAllowlist` | registration, StartKeeperClient, ... | Jobs allowed to run when the agent UI is inactive | Security-sensitive allowlist; misuse can launch UI jobs headlessly. | | `Settings:AllowedNonAdminExecutables` | product UI list | Binaries allowed without admin rights in the user context | Controls which Keeper UI helpers may run unelevated. | | `Settings:AlternativeSignatures` | \[] | Extra trusted code-signing thumbprints for plugins | Required if partners/internal builds sign plugins with non-Keeper certificates. | | `Settings:CertName` | "" | Certificate subject/name in store | Required whenever `CertStore` is used in corporate PKI deployments. | | `Settings:CertPassword` | "" | TLS certificate password | Secret value — vault/mask in the console; never store as plaintext. | | `Settings:CertPath` | "" | TLS certificate file path | Custom TLS for the local API using enterprise PKI paths. | | `Settings:CertStore` | "" | Windows certificate store name | For enterprises using Windows certificate stores instead of files. | | `Settings:CriticalSystemDirectories` | OS critical dirs | Directories protected from elevation/redirect tampering | Blocks grants that target OS-critical trees. | | `Settings:CriticalSystemFiles` | OS critical exes | Files protected from elevation/redirect tampering | Defines OS binaries that elevation/redirect must never rewrite. | | `Settings:MaintainKeeperAccount` | false | Persist the KeeperUserSession account across restarts (Windows hybrid AAD + Intune) | Required for hybrid AAD+Intune endpoints to retain elevation after reboot. | ### Service, Network & Messaging | Setting | Default | Description | Notes | | -------------------------------------------------------------------------------------------- | --------------------------- | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `*.metadata.mqttRole` (per plugin) | subscriber/publisher | Declares each plugin's MQTT role | Do not edit. Loader/authorization topology metadata, not a tunable setting. | | `*.metadata.mqttTopics` (per plugin) | plugin-specific | Per-plugin publish/subscribe topic arrays | Do not edit. Editing a plugin's MQTT role graph can silently break elevation, policy, or logging chains. | | `AllowedHosts` | `*` | ASP.NET Core host-header allowlist | Do not edit. This governs which HTTP Host headers the local management API accepts. Changing it without understanding reverse-proxy/header behavior can break the local API entirely. | | `broker.connectiontimeout` / `broker.keepalive` / `system.mqtt.enabled` (injected) | 10000 / 60 / true | Hardcoded MQTT connection tuning advertised to every plugin | Not configurable at all — literal constants in code. | | `broker.host` / `broker.port` (injected) | mirrors of broker settings | MQTT host/port injected into every plugin's settings | Duplicate mirror of the broker settings above; change the source once, not per plugin. | | `JobStore:StorePath` | "" (data dir) | Override path for persisted job store | Admins can relocate persisted job state for large fleets/storage policies. | | `Logging:LogLevel:Microsoft` | Information | ASP.NET `Microsoft.*` category log level | Framework noise knob; the equivalent Keeper-level logging controls are listed under Logging & Monitoring. | | `Logging:LogLevel:Microsoft.AspNetCore.Server.Kestrel` | Information | Kestrel web-server category log level | Rarely useful outside engineering diagnostics of the local HTTPS endpoint. | | `Logging:LogLevel:Microsoft.Hosting.Lifetime` | Information | Hosting lifetime category log level | Startup/shutdown framework logging, not an operational setting. | | `Logging:LogLevel:System` | Information | `System.*` framework category log level | Overlaps with the Keeper-specific logging controls listed under Logging & Monitoring. | | `Messaging:MalformedJsonRepair:EscapeMap` | Unicode control escapes | Maps control characters to JSON escapes when repairing malformed MQTT payloads | Do not edit. Internal defensive parser plumbing; incorrect values corrupt event JSON silently. | | `Messaging:MalformedJsonRepair:UnmappedControlCharacterFormat` | `\u{X4}` | Fallback escape format for unmapped control characters | Do not edit. Developer-facing repair format, not an operational policy. | | `metadata` (per plugin, via Admin API) | plugin's manifest JSON | Read-through mirror of a plugin's canonical manifest | Read-only. Source code explicitly documents this as not customer-tunable — the live manifest file always wins over any stored copy. | | `MqttBrokerSettings:IpAddress` | 127.0.0.1 | Embedded MQTT broker bind address (must stay localhost) | Must remain loopback for isolation; surfacing it lets admins audit/bind policy and reject non-localhost drift. | | `MqttBrokerSettings:Port` | 8675 | Embedded MQTT broker port | Broker port collisions break all plugins; admins can reassign 8675 without reinstalling the agent. | | `MqttJobPublishSettings:PublishMqtt:AllowedTopics` | product wildcards | Global allowlist of topics jobs may publish to | Do not edit. Security-critical fence for job processes; free-form edits can open broad publish access or break job status reporting. | | `MqttJobPublishSettings:PublishMqtt:MaxJsonArraySize` | 1000 | Max array/object element count accepted in `publish-mqtt` payloads | Same rationale as JSON depth; large-fleet event batching may need to exceed it. | | `MqttJobPublishSettings:PublishMqtt:MaxJsonDepth` | 10 | Max JSON nesting depth accepted in `publish-mqtt` payloads | Bounds JSON-parsing cost/attack surface for job-published messages. | | `MqttJobPublishSettings:PublishMqtt:MaxPayloadSizeBytes` | 10240 | Soft cap on `publish-mqtt` job-command payload size | Raise if legitimate payloads exceed the 10KB default. | | `MqttJobPublishSettings:PublishMqtt:MaxPayloadSizeBytesHardLimit` | 102400 | Compile-time hard ceiling on `publish-mqtt` payload size | This is a code-enforced safety ceiling above the tenant-tunable soft cap and cannot be changed via configuration. | | `MqttJobPublishSettings:ShowToast:MaxPayloadSizeBytes` / `ShowToast:DefaultSeverity` | 10240 / Info | Payload cap and default severity for the `show-toast` job command | Do not edit. Raising the payload cap without coordinated client changes can cause silent message drops. | | `MqttTopics:AuditTopic` | AuditMessage | Logical audit topic name | Do not edit. Renaming breaks every publisher/subscriber that expects `AuditMessage`. | | `MqttTopics:publish` | product topic list | Host MQTT client publish allowlist | Do not edit. This is the product's pub/sub contract; edits desync plugins from the broker and drop audit/policy traffic. | | `MqttTopics:subscribe` | product topic list | Host MQTT client subscribe allowlist | Do not edit. Ship-with-build wiring, not an estate policy setting. | | `publishing.topic` / `.qos` / `.retain` / `.frequency`, `message.payloadformat` / `.maxsize` | various | Default MQTT wiring handed to any plugin lacking its own configuration | Do not edit. Internal protocol defaults, not an independent tenant setting. | | `security.usetls` (injected) | false | Default TLS-usage flag for plugin MQTT/HTTP connections | Do not edit. Flipping this fleet-wide without coordinated certificate/broker configuration will break connections. | | `Settings:KestrelHttpPort` | 6988 | Local HTTP management API port | Port conflicts and local tooling require fleet-wide control of this endpoint. | | `Settings:KestrelHttpsPort` | 6989 | Local HTTPS management API port | Plugins and jobs call the HTTPS API; relocate it if 6989 is taken or firewalled. | | `Settings:PluginPath` | Plugins | Plugin manifest directory | Supports non-default plugin layouts (side-by-side builds, golden images). | | `Settings:RepositoryPath` | KeeperStorage | Encrypted local repository root | Relocate encrypted state to custom data volumes or separate from Program Files. | | `Settings:ScriptsPath` | Jobs/Scripts | Job script assets directory | Job scripts are referenced as `{ScriptsPath}`; relocate for least-privilege ACLs. | | `Settings:ServiceName` | KeeperPrivilegeManager | Windows service / process display name | Some enterprises require a branded or environment-specific service name. | | `Settings:SharedRepositoryPath` | SharedRepository | Shared cross-plugin storage root | Cross-plugin shared state may need a tenant-chosen volume for backup/capacity planning. | | `Subscription.Topic` / `Qos` / `CleanSession` (per plugin) | per plugin | Primary MQTT subscription block on each plugin's manifest | Do not edit. Changing QoS/CleanSession without coordinated code changes is unsupported and can disconnect the plugin from the broker. | | `system.service.https_port` / `.http_port` / `.name` (injected) | mirrors of service settings | Service identity/port re-projected to every plugin | Duplicate mirror of the service settings above. | ### Session & Watchdog | Setting | Default | Description | Notes | | ---------------------------------------------------------------------------------------------- | -------------------------- | -------------------------------------------------------- | -------------------------------------------------------------------- | | `SessionEventDispatcher:StartKeeperClientCoalesceSeconds` | 12 | Debounce rapid session events before starting the client | Prevents duplicate KeeperClient launches from bursty logon events. | | `SessionMonitoring:Enabled` | true | Enable user-session polling | Master switch for detecting logons/sessions that start KeeperClient. | | `SessionMonitoring:ExcludedUsers` | SYSTEM, LOCAL SERVICE, ... | Accounts excluded from session handling | Prevents session handling for service accounts. | | `SessionMonitoring:LinuxDesktopProcesses` | gnome-shell, kwin, ... | Linux processes that indicate an interactive desktop | Desktop-session heuristics differ by distro/DE. | | `SessionMonitoring:MacOSDesktopProcesses` | Dock, Finder, WindowServer | macOS processes that indicate an interactive desktop | Customize for atypical macOS environments. | | `SessionMonitoring:PollingIntervalSeconds` | 5 | How often active sessions are scanned | CPU vs. detection-latency knob for dense/VDI hosts. | | `SessionMonitoring:StartKeeperClientOnLogin` | true | Launch KeeperClient when a user logs in | Required for request/approval workflows to be reachable. | | `SessionMonitoring:StartKeeperClientOnReconnect` | true | Relaunch KeeperClient on session reconnect | Needed for RDP/reconnect scenarios. | | `system.transaction.default_timeout_minutes` / `.max_per_plugin` / `.cleanup_interval_minutes` | product defaults | Legacy transaction timing values | Compatibility path; not used by the primary transaction flow. | | `transaction.enabletracking` (system-level, Admin API) | legacy flag | Legacy transaction tracking switch | Compatibility flag. | | `transaction.enabletracking` (system-level, Admin API) | legacy flag | Legacy transaction tracking switch | Compatibility flag. | | `Watchdog:AutoRemediate` | true | Automatically restart unhealthy KEPM components | Chooses self-healing vs. alert-only when unhealthy. | | `Watchdog:CheckIntervalSec` | 10 | Watchdog health-check interval | Faster intervals detect outages sooner but add host noise. | | `Watchdog:StartupDelaySec` | 90 | Grace period after boot before remediation | Avoids false unhealthy restarts during slow boots/AV scans. | | `Watchdog:UnhealthyRestartThreshold` | 3 | Consecutive failures before restart | Prevents flapping on transient blips. | ### Storage Storage-engine and generated state used by the agent. | Setting | Default | Description | Notes | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------------- | | Runtime and encrypted state | generated content | Inventory/AI mirrors, deployment manifests, encrypted repositories, and internal job-store bounds | Generated or derived state. | | `StorageConfiguration.EnableUsernameIsolation` / `.DefaultEncryption` / `.DefaultFormat` / `.EnableAuditLogging` / `.EnablePerformanceMetrics` / `.MaxConcurrentOperations` / `.RetryAttempts` / `.RetryDelayMs` / `.EnableStreamingStorage` / `.StreamingBatchSize` / `.EnableCompression` / `.CustomStoragePath` / `.SharedStorage` / `.BasePath` / `.SharedPath` | product defaults | Encrypted-storage engine options for encryption, format, paths, sharing, batching, compression, retries, and metrics | Storage-engine configuration. | ### Windows Injector Windows elevation-injection components and their fixed launch contract. | Setting | Default | Description | Notes | | ------------------------- | ---------------- | ------------------------------------------------- | ---------------------------------------------------------------------------- | | Windows Injector settings | product defaults | Windows process-injection and inspection behavior | Internal/runtime controls; add individual keys only after source validation. | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/architecture/configuration-settings.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.