Skip to main content

Configure device policies

Recommended: Use Device Configuration Profiles

While CLI-based policy management remains fully supported, we recommend using Device Configuration Profiles for centralized policy management. Profiles let you configure and deploy browser policies from the Keep Aware console without requiring manual CLI commands on each device. See Deploy device configurations for details.

Keep Aware supports browser device policy management through a unified JSON configuration file. This allows you to control browser security settings like private mode, developer tools, guest browsing, and homepage settings across Chrome, Edge, Firefox, and other browsers.

What is a device policy?​

A device policy (also known as a machine configuration) is a configuration set at the device level for web browsers. Chrome and Edge traditionally use Group Policy and MDM to configure different settings on the browser; Keep Aware provides a simpler alternative using a JSON file that deploys policies to all supported browsers automatically.

Quick start​

Once Keep Aware is installed, the easiest way to begin using machine policies is through the command line. All policy commands must be run with elevated permissions.

Recommended settings include:

  • Forced Keep Aware in private mode
  • Disabled guest mode
  • Disabled developer tools Apply them with:
keepaware policy enable-recommended
keepaware policy refresh

Modify or extend policies​

These configurations can be changed individually. Device policies only need to be enabled once.

keepaware policy enable
keepaware policy set DeveloperToolsAvailable '*' false
keepaware policy refresh

Remove all policies​

keepaware policy disable

This removes all settings and deletes the policy file.

tip

In all command examples, replace keepaware with the full path to the Keep Aware executable.

Recommended polices can be configured as a batch. The default values are:

  • ForcedInPrivateMode: true
  • DeveloperToolsAvailable: false
  • DisableBrowserGuestMode: true

Custom policies​

Keep Aware supports six cross-browser policy keys. These allow you to configure private mode, developer tools, guest mode, homepages, new tab pages, and extension behavior in private browsing.

(Each policy description follows below.)

Set individual policies​

# Set for all browsers
keepaware policy set <POLICY_NAME> '*' <VALUE>

# Set for specific browser
keepaware policy set <POLICY_NAME> <BROWSER> <VALUE>

# Examples
keepaware policy set DeveloperToolsAvailable '*' false
keepaware policy set Homepage chrome https://example.com
keepaware policy set PrivateModeAvailable firefox null

Always refresh after setting policies:

keepaware policy refresh

Disable policies​

keepaware policy disable

This removes all settings and deletes the policy file.

Supported policies​

Keep Aware supports six browser-agnostic policies that work across Chrome, Edge, Firefox, and other browsers.

PrivateModeAvailable​

Private/incognito mode can be turned on or off using a simple true/false setting, letting you control whether users are allowed to open private browsing sessions. Values: true (available), false (disabled)

Example:

sudo keepaware policy set PrivateModeAvailable '*' false

Browser policy keys: This setting translates to the browser-specific keys.

  • Chrome/Edge/others: IncognitoModeAvailability (0=enabled, 1=disabled, 2=forced)
  • Firefox: DisablePrivateBrowsing (inverted logic)

ForcedInPrivateMode​

Ensures that the Keep Aware extension is always enabled in private/incognito sessions so monitoring stays consistent even in private browsing. Values: true (forced), false (normal)

Example:

sudo keepaware policy set ForcedInPrivateMode chrome true

Browser policy keys: This setting translates to the browser-specific keys.

  • Chrome: MandatoryExtensionsForIncognitoNavigation (requires EnableExperimentalPolicies)
  • Edge: MandatoryExtensionsForInPrivateNavigation
  • Firefox: ExtensionSettings.{id}.private_browsing

DeveloperToolsAvailable​

Controls whether users can open browser developer tools, helping you prevent inspection, debugging, or modification of web content. Values: true (available), false (disabled)

Example:

sudo keepaware policy set DeveloperToolsAvailable '*' false

Browser policy keys: This setting translates to the browser-specific keys.

  • Chrome/Edge/others: DeveloperToolsAvailability (0=allow, 1=disallow on enterprise, 2=disallow)
  • Firefox: DisableDeveloperTools

DisableBrowserGuestMode​

Lets you enable or disable guest browsing so you can prevent users from opening anonymous, non-accounted sessions. Values: true (disabled), false (available)

Example:

sudo keepaware policy set DisableBrowserGuestMode '*' true

Browser policy keys: This setting translates to the browser-specific keys.

  • Chrome/Edge/others: BrowserGuestModeEnabled (inverted: false=disabled, true=enabled)
  • Firefox: Not applicable

Homepage​

Allows you to set a specific homepage URL so all users start on the same landing page when they open their browser. Values: "string" (a valid URL)

Example:

sudo keepaware policy set Homepage '*' https://intranet.company.com

Browser policy keys: This setting translates to the browser-specific keys.

  • Chrome/Edge/others: HomepageLocation
  • Firefox: Homepage.URL (nested structure)

NewTabPage​

Lets you define the page that opens in a new tab, enabling you to guide users toward internal resources or a standard portal. Values: "string" (a valid URL)

Example:

sudo keepaware policy set NewTabPage '*' https://portal.company.com

Browser policy keys: This setting translates to the browser-specific keys.

  • Chrome/Edge/others: NewTabPageLocation
  • Firefox: OverrideFirstRunPage

Example Configurations​

Recommended policies:

{
  "policies": {
    "*": {
      "ForcedInPrivateMode": true,
      "DeveloperToolsAvailable": false,
      "DisableBrowserGuestMode": true
    }
  }
}

Editing policies manually​

After policies are enabled, you can edit the configuration file directly (requires elevated permissions). Run keepaware policy refresh after making any changes.

File Location​

  • macOS/Linux: /etc/keepaware-policies.json
  • Windows: C:\ProgramData\Keep Aware\keepaware-policies.json

JSON structure

{
  "policies": {
    "*": {
      "PolicyName": value
    },
    "chrome": {
      "PolicyName": value
    },
    "edge": {
      "PolicyName": value
    },
    "firefox": {
      "PolicyName": value
    }
  }
}

Key types:

  • "*" - Global settings (apply to all browsers)
  • "chrome", "edge", "firefox", "brave", etc. - Browser-specific overrides Value types: true, false, "string", or null (to unset)

Example with browser overrides:

{
  "policies": {
    "*": {
      "DeveloperToolsAvailable": false,
      "Homepage": "https://intranet.company.com"
    },
    "chrome": {
      "NewTabPage": "https://google.com"
    },
    "firefox": {
      "DeveloperToolsAvailable": null,
      "Homepage": "https://duckduckgo.com"
    }
  }
}

Troubleshooting​

Verify Policies in Browser​

Chrome/Edge:

  • Navigate to chrome://policy or edge://policy
  • Check for Keep Aware policies in the list

Firefox:

  • Navigate to about:policies
  • Check "Active" tab for Keep Aware policies

Check Configuration​

# View policy file
cat /etc/keepaware-policies.json  # macOS/Linux
type "C:\ProgramData\Keep Aware\keepaware-policies.json"  # Windows

# Check if policies are enabled
grep POLICY /etc/keepaware.conf  # macOS/Linux

Common Issues​

Policies not applying:

  1. Verify INSTALL_BROWSER_POLICY=1 in /etc/keepaware.conf
  2. Verify USE_CUSTOM_POLICIES=1 or USE_RECOMMENDED_POLICIES=1
  3. Restart browsers after applying policies
  4. Validate JSON syntax in policy file

Permission errors:

  • Run all policy commands with sudo (macOS/Linux) or as Administrator (Windows)

Policy file missing:

keepaware policy enable

Table of Contents