Least Privilege Policy

Remove local admin from standard users on the target endpoint

Overview

The Keeper Least Privilege policy will remove local admin from standard users on the target endpoint. On Windows devices, Keeper will not remove administrative rights from built-in admin accounts or root accounts. See the Protected Administrators Exclusion List section for details.

Least Privilege policies may incorporate granular command-level restrictions to ensure that elevation is scoped only to approved commands or operational contexts. This reduces excessive privilege exposure within permitted applications.

Policy Interaction or Enforcement Model

Least Privilege policies operate in conjunction with Application AllowList and DenyList controls. When default-deny strategies are implemented, least privilege enforcement ensures that only explicitly permitted applications and approved elevated actions are allowed.

Before Enabling Least Privilege

Least Privilege directly changes what matched users can do on their machines, so it has the highest disruption potential of any KEPM policy type. Before switching to Enforce:

• Confirm Privilege Elevation policies are configured and tested so users still have a governed path to perform actions they may need after demotion (installing approved software, running admin tools).

• Finalize the exclusion list — IT staff, break-glass accounts, and service accounts that require standing admin. See the Exclusion List section below.

• Ensure a helpdesk escalation path exists for users who hit unexpected friction.

• Pilot enforcement with a small, non-critical deployment group before rolling out org-wide.

For the full rollout sequence, see Policy: Phased Rollout Planning.

Activating Least Privilege

From the Admin Console > Endpoint Privilege Manager > Policies create a new policy. Select "Least Privilege" from the policy type and then "Enforce".

Visit the "Advanced" section to apply an exclusion policy to any local admins which should not be managed by Keeper.

Exclusion List

When the Least Privilege Policy is applied, Keeper will remove local admin rights from any user that is not in the "exclusion" list. This list is defined in the Advanced settings of the policy editor page.

Ensure that your default admin username is defined in the exclusion list, or admin rights will be removed from this user after policy has been applied.

The section to modify is below:

"CertificationCheck": [],
"Extension": {
    "Exclusions": [
        "your_username_to_exclude"
    ]
},

---

Protected Administrators Exclusion List

Keeper protects the following administrators by default through SID (security identifier) pattern matching and enhanced detection. This prevents enforcing least privilege on root accounts.

1. Well-Known SID Patterns

• S-1-5-32-544 - Built-in Administrators group

• S-1-5-18 - SYSTEM account

• S-1-5-19 - LOCAL SERVICE

• S-1-5-20 - NETWORK SERVICE

2. Domain Administrator SID Patterns

• S-1-5-21-*-512 - Domain Admins (any domain)

• S-1-5-21-*-519 - Enterprise Admins (forest root domain)

• S-1-5-21-*-518 - Schema Admins (forest root domain)

• S-1-5-21-*-500 - Built-in Administrator account (any domain)

Additional Protected Accounts

• KeeperUserSession - Always protected (service account)

• Built-in Administrator - Always protected (even if renamed)

Linux / macOS Protected Accounts

• Linux and macOS "root" user