> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/policies/policy-types/advanced-policy-types/keeper-updates.md).

# Keeper Updates

<figure><img src="/files/MYSwcTs1uNS4mnAbt7FT" alt=""><figcaption></figcaption></figure>

Use a **Keeper Updates** policy to centrally declare which version of KEPM each managed endpoint should run, and let endpoints converge to that version automatically. Instead of manually reinstalling the agent on every machine, you set a desired version once and target it to a Machine Collection.

### What this Policy is For

* Keeping endpoints automatically current with the **latest** released version of KEPM.
* **Pinning** a specific version (for validation, staged rollout, or change-control windows) so targeted endpoints hold at an explicit version until you change the policy.
* Governing update behavior per group of machines through standard policy targeting.

{% hint style="info" %}
**No matching policy = no auto-update.** If no Keeper Updates policy applies to a machine, that endpoint does not auto-update and stays on whatever version is installed. Auto-update is opt-in per machine, controlled entirely by targeting.
{% endhint %}

### How it Works

The Keeper Updates policy is an **Advanced Mode (JSON)** policy. You create it like any other policy in the Admin Console, then switch to Advanced Mode to set its type and `Extension` payload.

1. The backend persists the policy with its `Extension` payload (desired `Version` + `ManifestUrl`).
2. The endpoint's updater runs a checkup at agent **startup**, on a recurring **interval**, and immediately on **policy change** (push). All three paths run the same logic.
3. The updater resolves the effective desired version for the machine from the Keeper Updates policies that target it. If none apply, the checkup exits with no change.
4. The desired version is compared against the installed version. If they differ, the updater fetches the package manifest from `ManifestUrl`, selects the correct artifact for the component and OS, and **verifies its checksum and signature** before anything is written to disk.
5. The update is applied, then a stabilization window watches the component's health. If the component is healthy, the update is committed; if it fails or destabilizes, the agent rolls back to the last known good version. Every outcome emits an audit event.

### Step-by-Step: Create a Keeper Updates policy (via Advanced JSON)

{% stepper %}
{% step %}

### **Navigate to Endpoint Privilege Manager → Policies**

<figure><img src="/files/S7fCASHNZyqH5baIgtcT" alt="" width="90"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Click the Create Policy button**

This spawns the Create Policy modal form.

<figure><img src="/files/kPKQiHsNY3AOE9v183kX" alt="Create Policy Form" width="375"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Define Policy Attributes**

Give the policy a clear, descriptive name (for example, *Keeper Updates – Pin 1.1.0*).

Choose **any existing policy type available in the UI** as a starting template — the type is overridden to `KeeperUpdate` in JSON in a later step.

Choose a status for the policy. Use **Monitor** mode while you validate targeting, then switch to **Enforce** when you are ready for endpoints to act on it.

<figure><img src="/files/y1JWq1VqAKA02cT0CL8q" alt="" width="375"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Configure Policy Targeting**

<figure><img src="/files/7NLjG0ybK7zwB85JjCSq" alt="" width="375"><figcaption></figcaption></figure>

Set the **Machine Collection** the policy applies to. This determines which endpoints converge to the desired version. Leave **User** and **Application** targeting as `*` — a Keeper Updates policy governs machines, not user or application context.

<figure><img src="/files/BJ2qJErhY4Zf6xX6g6En" alt="" width="375"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Open the policy's Advanced Mode (JSON view)**

Click the **Advanced Mode** link in the bottom-left corner of the Policy form.

<figure><img src="/files/xpMkAJLrrVMlvUUNjU3H" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Redefine the Policy Type in JSON**

Set `PolicyType` to **`"KeeperUpdate"`**.

<figure><img src="/files/fQB54YY1KMlMgiyvT0WY" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Define the Extension fields**

Add an `Extension` object with the desired `Version` and the `ManifestUrl`, as described in [Required JSON Fields](#required-json-fields)

<figure><img src="/files/w4VJL05XwQEjc8WEQfIF" alt="" width="563"><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Save the Policy**

{% endstep %}

{% step %}

### Validate the Policy on an Endpoint

1. Confirm the endpoint is a member of the Machine Collection set in `MachineCheck`.
2. With the policy in **Enforce** mode, trigger a checkup — restart the agent, wait for the scheduled interval, or push the policy change (a policy update triggers a checkup automatically).
3. Confirm the endpoint converges to the desired version. An endpoint already at the desired version takes no action.
4. Confirm an endpoint **not** in the targeted collection does not change version.
   {% endstep %}
   {% endstepper %}

### Required JSON Fields

Set `PolicyType` to `"KeeperUpdate"` and include an `Extension` object with both of the following fields:

<table><thead><tr><th width="209.5333251953125">Field</th><th width="107.4000244140625">Required</th><th>Description</th></tr></thead><tbody><tr><td><code>Extension.Version</code></td><td>Yes</td><td>The desired version for targeted endpoints. Use <code>"latest"</code> to track the most recent release automatically, or an explicit semver (for example <code>"1.1.0"</code>) to pin endpoints to that version.</td></tr><tr><td><code>Extension.ManifestUrl</code></td><td>Yes</td><td>URL of the package manifest the updater reads to locate and verify update artifacts. The updater downloads the manifest, selects the correct package per component and OS, and verifies checksum and signature before installing.</td></tr></tbody></table>

**Targeting fields** (set in the UI, reflected in JSON):

<table><thead><tr><th width="267.86669921875">Field</th><th>Description</th></tr></thead><tbody><tr><td><code>MachineCheck</code></td><td>One or more Machine Collection UIDs the policy applies to. This is the field that scopes auto-update.</td></tr><tr><td><code>UserCheck</code> / <code>ApplicationCheck</code></td><td>Set to <code>["*"]</code> for Keeper Updates policies.</td></tr></tbody></table>

***

### Example JSON

```json
{
  "PolicyName": "Keeper Updates – Track Latest",
  "PolicyType": "KeeperUpdate",
  "PolicyId": "Z7brWcTiyOqvtBjZKFTnww",
  "Status": "enforce",
  "Actions": {
    "OnSuccess": {
      "Controls": ["ALLOW"]
    },
    "OnFailure": {
      "Command": ""
    }
  },
  "NotificationRequiresAcknowledge": false,
  "RiskLevel": 50,
  "Operator": "And",
  "Rules": [
    {
      "RuleName": "UserCheck",
      "ErrorMessage": "This user is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckUser()"
    },
    {
      "RuleName": "MachineCheck",
      "ErrorMessage": "This Machine is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckMachine()"
    },
    {
      "RuleName": "ApplicationCheck",
      "ErrorMessage": "This application is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckFile(false)"
    },
    {
      "RuleName": "DateCheck",
      "ErrorMessage": "Current date is not covered by this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckDate()"
    },
    {
      "RuleName": "TimeCheck",
      "ErrorMessage": "Current time is not covered by this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckTime()"
    },
    {
      "RuleName": "DayCheck",
      "ErrorMessage": "Today is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckDay()"
    },
    {
      "RuleName": "CertificateCheck",
      "ErrorMessage": "Certificate hash is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckCertificate()"
    }
  ],
  "UserCheck": ["*"],
  "MachineCheck": ["aDdMC3y_isged8ODDSnvRg"],
  "ApplicationCheck": ["*"],
  "DayCheck": [],
  "DateCheck": [],
  "TimeCheck": [],
  "CertificationCheck": [],
  "Extension": {
    "Version": "latest",
    "ManifestUrl": "https://qa.keepersecurity.com/pam/pedm/package-manifest.json"
  }
}
```

To pin endpoints to a specific version instead of tracking the latest release, change `Extension.Version` to the target semver:

```json
"Extension": {
  "Version": "1.1.0",
  "ManifestUrl": "https://qa.keepersecurity.com/pam/pedm/package-manifest.json"
}
```

{% hint style="info" %}
Pinning holds an endpoint at the specified version even if newer releases are published. To resume automatic updates, set `Extension.Version` back to `"latest"`.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://newdocs.keeper.io/en/keeperpam/endpoint-privilege-manager/policies/policy-types/advanced-policy-types/keeper-updates.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.