In short: Keeper Endpoint Privilege Manager removes standing local administrator rights from Windows, macOS and Linux devices and replaces them with policy-controlled elevation, with MFA, justification or approval for sensitive actions. It also governs file access, sudo commands and AI agent activity on the endpoint. It is part of Keeper Enterprise and licensed by endpoint seats.
What Keeper Endpoint Privilege Manager is
Most malware and many mistakes rely on the user having local administrator rights. Taking those rights away is one of the most effective controls an organisation can apply, and it supports the user access control requirement in Cyber Essentials. The problem is that people still need to install the occasional application or change a setting.
Keeper Endpoint Privilege Manager (EPM) resolves that. It takes away standing admin rights on Windows and controls sudo on macOS and Linux, then lets specific applications or commands be elevated when policy allows, using a Keeper-managed ephemeral account where needed.
Key capabilities
| Capability | What it does |
|---|---|
| Just-in-time elevation | Elevates an application or command when policy allows, instead of leaving users as permanent admins |
| Policy controls | Allow and deny lists, plus require MFA, require justification or require approval |
| Approval workflows | Approve requests in the Keeper Admin Console or via integrations with ServiceNow, Jira, Slack and Microsoft Teams |
| File access policies | Control access to sensitive files and folders |
| sudo governance | Command line policies for privileged commands on macOS and Linux |
| Agentic AI policies | Govern what AI agents running on the endpoint can access and elevate |
| Audit | Logs elevation requests and decisions for review |
Policies can run in Monitor mode first, so you can see what would be affected before you enforce anything.
How it is licensed
Keeper documents EPM as part of Keeper Enterprise, licensed by endpoint seats: you need enough seats for every device running the agent, and in Keeper's admin console seats are added in blocks. That differs from the rest of Keeper, which is per user, so if your staff use several devices each, count devices, not people. The Enterprise tenant also gives you the vault for admin credentials.
Ask us for a quote and we will confirm how seats are counted and the term for your order. For background see per-user vs per-device licensing.
Requirements and deployment
EPM uses a lightweight agent on each Windows, macOS or Linux device. Policies are defined once in the Keeper Admin Console and cached on the device, so most rules still apply when it is offline; steps that need MFA or an approval wait until it reconnects. Agents are installed from deployment packages, which can be pushed through your existing device management tool, such as Microsoft Intune. Syncing users and groups from Active Directory or Microsoft Entra ID lets you target policies by group.
We recommend a phased rollout: deploy to a pilot group in Monitor mode, review what users elevate, build allow rules for common tasks, then enforce by department.
Why remove local admin rights
Standing local admin rights let malware install itself, disable protection and move across the network using cached credentials. Removing them also cuts unapproved software and accidental configuration changes. EPM makes that achievable without a flood of support requests: common tasks are pre-approved, unusual ones go through a quick request, and every elevation is logged so you can show an auditor exactly who did what.
Who it suits and how we help
EPM suits organisations that have struggled to remove admin rights because of support calls, and those whose insurer or auditor asks about local admin. We scope seats, deploy the agent, build the first policy set from monitor data and manage the licence as devices change. Pair it with endpoint protection and see identity, MFA and privileged access for related options.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Keeper Endpoint Privilege Manager licensed per user or per device?
Per endpoint. Keeper counts seats for the devices running the EPM agent, unlike its password manager, which is per user. EPM is part of Keeper Enterprise.
Which operating systems does Keeper EPM support?
Windows, macOS and Linux, using an agent on each device.
Can users still install approved software without admin rights?
Yes. Policies can allow specific applications to elevate automatically, or require MFA, a justification or an approval first.