Keeper Updates

Manage how Keeper EPM updates are staged, approved, deferred, and rolled out across endpoints

Use a Keeper Updates policy to centrally declare which version of KEPM each managed endpoint should run, and let endpoints converge to that version automatically. Instead of manually reinstalling the agent on every machine, you set a desired version once and target it to a Machine Collection.

What this Policy is For

• Keeping endpoints automatically current with the latest released version of KEPM.

• Pinning a specific version (for validation, staged rollout, or change-control windows) so targeted endpoints hold at an explicit version until you change the policy.

• Governing update behavior per group of machines through standard policy targeting.

No matching policy = no auto-update. If no Keeper Updates policy applies to a machine, that endpoint does not auto-update and stays on whatever version is installed. Auto-update is opt-in per machine, controlled entirely by targeting.

How it Works

The Keeper Updates policy is an Advanced Mode (JSON) policy. You create it like any other policy in the Admin Console, then switch to Advanced Mode to set its type and Extension payload.

1. The backend persists the policy with its Extension payload (desired Version + ManifestUrl).

2. The endpoint's updater runs a checkup at agent startup, on a recurring interval, and immediately on policy change (push). All three paths run the same logic.

3. The updater resolves the effective desired version for the machine from the Keeper Updates policies that target it. If none apply, the checkup exits with no change.

4. The desired version is compared against the installed version. If they differ, the updater fetches the package manifest from ManifestUrl, selects the correct artifact for the component and OS, and verifies its checksum and signature before anything is written to disk.

5. The update is applied, then a stabilization window watches the component's health. If the component is healthy, the update is committed; if it fails or destabilizes, the agent rolls back to the last known good version. Every outcome emits an audit event.

Step-by-Step: Create a Keeper Updates policy (via Advanced JSON)

1

Navigate to Endpoint Privilege Manager → Policies

2

Click the Create Policy button

This spawns the Create Policy modal form.

3

Define Policy Attributes

Give the policy a clear, descriptive name (for example, Keeper Updates – Pin 1.1.0).

Choose any existing policy type available in the UI as a starting template — the type is overridden to KeeperUpdate in JSON in a later step.

Choose a status for the policy. Use Monitor mode while you validate targeting, then switch to Enforce when you are ready for endpoints to act on it.

4

Configure Policy Targeting

Set the Machine Collection the policy applies to. This determines which endpoints converge to the desired version. Leave User and Application targeting as * — a Keeper Updates policy governs machines, not user or application context.

5

Open the policy's Advanced Mode (JSON view)

Click the Advanced Mode link in the bottom-left corner of the Policy form.

6

Redefine the Policy Type in JSON

Set PolicyType to "KeeperUpdate".

7

Define the Extension fields

Add an Extension object with the desired Version and the ManifestUrl, as described in Required JSON Fields

8

Save the Policy

9

Validate the Policy on an Endpoint

1. Confirm the endpoint is a member of the Machine Collection set in MachineCheck.

2. With the policy in Enforce mode, trigger a checkup — restart the agent, wait for the scheduled interval, or push the policy change (a policy update triggers a checkup automatically).

3. Confirm the endpoint converges to the desired version. An endpoint already at the desired version takes no action.

4. Confirm an endpoint not in the targeted collection does not change version.

Required JSON Fields

Set PolicyType to "KeeperUpdate" and include an Extension object with both of the following fields:

Field	Required	Description
Extension.Version	Yes	The desired version for targeted endpoints. Use "latest" to track the most recent release automatically, or an explicit semver (for example "1.1.0") to pin endpoints to that version.
Extension.ManifestUrl	Yes	URL of the package manifest the updater reads to locate and verify update artifacts. The updater downloads the manifest, selects the correct package per component and OS, and verifies checksum and signature before installing.

Targeting fields (set in the UI, reflected in JSON):

Field	Description
MachineCheck	One or more Machine Collection UIDs the policy applies to. This is the field that scopes auto-update.
UserCheck / ApplicationCheck	Set to ["*"] for Keeper Updates policies.

---

Example JSON

{
  "PolicyName": "Keeper Updates – Track Latest",
  "PolicyType": "KeeperUpdate",
  "PolicyId": "Z7brWcTiyOqvtBjZKFTnww",
  "Status": "enforce",
  "Actions": {
    "OnSuccess": {
      "Controls": ["ALLOW"]
    },
    "OnFailure": {
      "Command": ""
    }
  },
  "NotificationRequiresAcknowledge": false,
  "RiskLevel": 50,
  "Operator": "And",
  "Rules": [
    {
      "RuleName": "UserCheck",
      "ErrorMessage": "This user is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckUser()"
    },
    {
      "RuleName": "MachineCheck",
      "ErrorMessage": "This Machine is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckMachine()"
    },
    {
      "RuleName": "ApplicationCheck",
      "ErrorMessage": "This application is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckFile(false)"
    },
    {
      "RuleName": "DateCheck",
      "ErrorMessage": "Current date is not covered by this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckDate()"
    },
    {
      "RuleName": "TimeCheck",
      "ErrorMessage": "Current time is not covered by this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckTime()"
    },
    {
      "RuleName": "DayCheck",
      "ErrorMessage": "Today is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckDay()"
    },
    {
      "RuleName": "CertificateCheck",
      "ErrorMessage": "Certificate hash is not included in this policy",
      "RuleExpressionType": "BuiltInAction",
      "Expression": "CheckCertificate()"
    }
  ],
  "UserCheck": ["*"],
  "MachineCheck": ["aDdMC3y_isged8ODDSnvRg"],
  "ApplicationCheck": ["*"],
  "DayCheck": [],
  "DateCheck": [],
  "TimeCheck": [],
  "CertificationCheck": [],
  "Extension": {
    "Version": "latest",
    "ManifestUrl": "https://qa.keepersecurity.com/pam/pedm/package-manifest.json"
  }
}

To pin endpoints to a specific version instead of tracking the latest release, change Extension.Version to the target semver:

"Extension": {
  "Version": "1.1.0",
  "ManifestUrl": "https://qa.keepersecurity.com/pam/pedm/package-manifest.json"
}

Pinning holds an endpoint at the specified version even if newer releases are published. To resume automatic updates, set Extension.Version back to "latest".