> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/deployment/deployment-reference/maintainkeeperaccount-configuration.md). # MaintainKeeperAccount Configuration The `MaintainKeeperAccount` setting controls whether the KeeperUserSession ephemeral administrator account persists between Keeper EPM service restarts. It exists primarily for Windows environments with specific identity management requirements — most commonly hybrid Azure AD (Microsoft Entra ID) + Intune deployments, and other environments where local account churn causes downstream issues. By default the setting is disabled, and Keeper EPM deletes and recreates the KeeperUserSession account on every service restart. This is the correct behavior for most deployments. Enable the setting only when account churn is causing measurable problems. For background on the account itself, see the KeeperUserSession Ephemeral Account reference. ### Configuration The setting lives in the `Settings` section of the Keeper EPM service's `appsettings.json`: ```json { "Settings": { "MaintainKeeperAccount": false } } ```
SettingTypeDefaultDescription
MaintainKeeperAccountbooleanfalseWhen true, the KeeperUserSession account persists across service restarts instead of being deleted and recreated.
**Applies to:** Windows. The setting has no effect on macOS or Linux. **Restart required:** The setting is read at service startup and shutdown. Changes take effect on the next service restart cycle. **Preferred deployment method:** Rather than editing `appsettings.json` directly on each endpoint, push the setting from a central SettingsUpdate policy. See Use a Policy to Set Settings for the policy-driven pattern. ### When to Enable #### Enable When **Hybrid Azure AD + Intune Environments** Azure AD Connect may sync local accounts on domain-joined or hybrid-joined endpoints. When Keeper EPM deletes and recreates KeeperUserSession on each service restart, Azure AD sees continuous account churn — creating and deleting the same account name with different SIDs each time. Symptoms include: * Azure AD sync delays or backlog * Intune policies that reference the KeeperUserSession SID losing their target on each restart * Compliance alerts triggered by unexpected local-account activity **Active Directory Environments with Aggressive Sync** Any AD environment where account changes trigger downstream sync events, external process runs, or audit alerts benefits from a stable account rather than churn. **Performance-Sensitive Deployments** Account creation involves SAM database writes. On systems with slow SAM operations, or where minimizing service restart time is critical, persisting the account eliminates the create-on-start cost. #### Keep Disabled (by Default) When **Standard deployments** Most Windows deployments — standalone workstations, domain-joined systems without Azure AD hybrid join, environments with no sync sensitivity — should leave this at the default. Fresh credentials on every restart is the cleaner security posture. **Maximum security requirements** Environments that require fresh credential material on every restart, or that treat any persistent local admin account as an audit finding, should keep the default. **Testing and development** A clean slate between restarts makes reproducing issues easier. ### Behavior Comparison #### Default: `MaintainKeeperAccount = false`
EventBehavior
Service startsDelete any existing KeeperUserSession account, then create a new one with a freshly generated password
Service stopsDelete the KeeperUserSession account
Service crashesOrphaned account cleaned up on next startup
Profile foldersOrphaned C:\Users\KeeperUserSession.* folders cleaned up by the profile-folder cleanup job
Advantages: fresh credentials on each restart; no persistent local admin account when the service is stopped; cleaner security posture. #### Enabled: `MaintainKeeperAccount = true`
EventBehavior
Service startsReuse the existing KeeperUserSession account (password rotated)
Service stopsKeep the KeeperUserSession account
Service crashesAccount remains; reused on restart
Profile foldersOrphaned profile folders still cleaned up (though far fewer are generated)
Advantages: faster startup (no delete/create cycle); stable account SID for Azure AD sync and Intune policy targeting; no sync churn. ### Security Considerations The KeeperUserSession password is cryptographically generated, protected at rest via DPAPI on Windows, rotated on each service restart (or each elevation, when the account is persistent), and never exposed to end users or written to logs. See the KeeperUserSession Ephemeral Account page for full password-generation and handling details. When `MaintainKeeperAccount = true`, additional considerations apply: * **Account persistence risk:** A local administrator account remains on the endpoint when the Keeper EPM service is stopped. If the service is uninstalled without cleanup, the account may remain. Ensure your uninstall procedures include account removal. * **Auditing:** Include KeeperUserSession in regular local-admin audits. Monitor for authentication attempts or process launches that were not initiated by Keeper EPM. * **Access restriction:** Where possible, restrict the account via Group Policy — for example, deny interactive logon, deny network logon, deny logon through Remote Desktop Services. Keeper EPM only needs the account for local process elevation. ### Orphaned Profile Folders On Windows, deleting and recreating the KeeperUserSession account can leave behind profile folders under `C:\Users`, for example: * `C:\Users\KeeperUserSession` * `C:\Users\KeeperUserSession.12-30-HOSTNAME` * `C:\Users\KeeperUserSession.12-30-HOSTNAME.000`, `.001`, `.002`, and so on These are cosmetic — they don't affect Keeper EPM functionality — but they can accumulate on the disk over time, especially on endpoints that restart the service frequently. Keeper EPM automatically cleans them up via the **ephemeral-orphan-profile-folders-cleanup** scheduled job, which runs every 5 minutes. The job deletes any folder under `C:\Users` whose name is exactly `KeeperUserSession` or begins with `KeeperUserSession.`, and removes the matching `ProfileList` registry entries under `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList`. Enabling `MaintainKeeperAccount = true` largely eliminates the churn that causes these folders to accumulate in the first place. ### Troubleshooting #### Account is Deleted Despite MaintainKeeperAccount Being True **Diagnosis:** Check the Keeper EPM service logs at startup. When the setting is correctly enabled, you will see: ``` MaintainKeeperAccount is enabled - skipping account deletion on startup (account will be reused) ``` If instead you see: ``` Starting KeeperUserSession ephemeral account cleanup KeeperUserSession deleted or did not exist ``` then the setting is being read as `false`. **Resolution:** 1. Confirm the setting is in the `Settings` section of `appsettings.json`, not another section 2. Confirm the JSON is syntactically valid (a syntax error causes the file to fail to load and all settings to fall back to defaults) 3. Restart the Keeper EPM service and re-check the logs 4. If you push settings via a SettingsUpdate policy, confirm the policy has run and the merge succeeded #### Azure AD Reports Frequent Account Additions/Deletions **Cause:** Keeper EPM is deleting and recreating KeeperUserSession on each service restart, and Azure AD Connect is syncing each event. **Resolution:** 1. Enable `MaintainKeeperAccount = true` 2. Confirm Azure AD Connect sync scope doesn't include the KeeperUserSession account (either by scope filter or by excluding it explicitly) 3. Consider excluding local system accounts from sync where organizational policy allows #### Orphaned KeeperUserSession Folders Accumulating in C:\Users **Cause:** Either the cleanup job is not running, or new folders are being created faster than cleanup can remove them. **Resolution:** 1. Verify the Keeper EPM service is running as `SYSTEM` and has permission to modify `C:\Users` 2. Verify the **ephemeral-orphan-profile-folders-cleanup** job is enabled and scheduled 3. If churn is the underlying cause, enable `MaintainKeeperAccount = true` 4. For manual cleanup: ```powershell # Run as administrator Get-ChildItem "C:\Users" -Filter "KeeperUserSession*" -Directory | Remove-Item -Recurse -Force ``` Also remove the matching entries under `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList` if any remain. ### Recommendations 1. **Assess your environment first.** Before enabling, confirm you are actually experiencing Azure AD sync churn, Intune SID targeting failures, or measurable startup delays. Don't enable prophylactically. 2. **Document which endpoints have it enabled and why.** Useful for security audits, troubleshooting, and compliance reporting. 3. **Test in staging.** Enable on a non-production endpoint first, verify the Azure AD or Intune symptoms improve, and confirm security monitoring still captures account activity as expected. 4. **Include KeeperUserSession in regular security audits** whenever the account is persistent. 5. **Deploy via SettingsUpdate policy** rather than manual `appsettings.json` edits, to keep configuration centralized and reproducible. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/deployment/deployment-reference/maintainkeeperaccount-configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.