Skip to main content

Deploying to Windows

As a browser-based platform, Keep Aware is highly compatible with the Microsoft Windows operating system. For browser compatibility notes, see Specifications & Constraints.

Getting started​

Before you begin, make sure you have access to an administrative or MDM platform such as Group Policy, Intune, or another tool that can run PowerShell or MSI installers. For manual installs, you’ll need a company email.

Finally, find your Keep Aware tenant key (ka_host) and start key (ka_start) by opening the Settings page, and selecting View tenant details for your organization.

Windows deployment​

Keep Aware can be quietly installed on Windows through a MSI file. The installer initiates the Keep Aware client which periodically checks for available browsers on the device and coordinates the installation of the Keep Aware browser extension.

Once downloaded, unzip the installer and deploy with the following command, or through the installer capability in your MDM platform.

Installing with command-line​

Command-line parameters

Mandatory Parameters

  • KA_HOST (string) => This value is available in the settings section of the console
  • KA_START (string) => This value is available in the settings section of the console
  • KA_NAME (string) => This is the name of your organization. e.g. Example, Inc.

Optional Parameters

  • SCRIPT_DIRECTORY (directory) => If you wish to install the native device components to a non-default directory, please indicate it here. (Default: C:\Program Files\Keep Aware)

Optional Installer Flags These flags must be given a 1 or a 0 as values. A 1 will enable this feature, a 0 will disable it, descriptions and defaults listed below:

  • INSTALL_EXTENSION (Default: enabled) => Enabling this flag will cause the installer to install the browser extension on all supported browsers on the local device
  • INSTALL_POLICY (Default: enabled) => Enabling this flag will cause the installer to install policy keys to each supported browser on the local device
  • INSTALL_NATIVE_MESSAGING (Default: enabled) => Enabling this flag will cause the installer to setup native device communication between the browser and the host device
  • INSTALL_SCHEDULED_TASK (Default: enabled) => Enabling this flag will cause the installer to setup a periodic background task to ensure local device data is kept up to date in the Keep Aware Console
  • SELF_HOSTED (Default: diabled) => Enabling this flag will cause the installer to install the browser extension on chromium based browsers from the Keep Aware extension repository instead of the Chrome Web Store
  • EDGE_HOSTED (Default: diabled) => Enabling this flag will cause the installer to install the browser extension on Edge based browsers from the Keep Aware extension repository instead of the Microsoft Extension Store
  • FIREFOX_HOSTED (Default: enabled) => Enabling this flag will cause the installer to install the browser extension on Firefox based browsers from the Keep Aware extension repository instead of the Mozilla Extension Store
  • IMPERSONATE_USER (Default: enabled) => Enabling this flag will cause the installer to run the install process as the local admin user, this is needed for most cases however may need to be disabled if specific security restrictions require a different admin permissions to allow running of a software install package
  • SILENT_RUNNING (Default: enabled) => Enabling this flag will cause the installer to run the install process as a background forked process, this is usually the preferred option however certian security configurations related to processing execution may require this field to be disabled

Core components​

Each deployment method involves the following core components:

  • Keep Aware browser extension: Chrome, Edge, Firefox, Brave and other browsers.
  • Keep Aware client: Typically installed through an installer or package, the client allows information to be synced across browsers on the same device.
  • Managed policy keys: Install keys, the Keep Aware tenant key, and the Keep Aware start key help initialize a browser's connection to a Keep Aware tenant and force-install the extension across web browsers.

Verifying the deployment​

Once deployed, devices should near immediately check in to the Devices page in the console. As browser policy is synced browsers will appear online in the Browsers page. While not required in most cases, restarting the browser will force a policy refresh.

Deploying with existing browser policy​

Keep Aware automatically respects your existing browser policies. When deployed, it safely adds or removes its own settings without disrupting configurations in Chrome, Edge, Firefox, or other browsers.

tip

For production deployments, we recommend consolidating your browser policies and adding Keep Aware settings alongside your existing configurations. Learn more

Enforcing the extension through MDM​

With the client installed, a production deployment can still layer Keep Aware extension alongside your existing browser policies.

In some environments, you may choose to deploy Keep Aware as an extension only. Most core features run through the extension, while installing the full client adds deeper capabilities such as local device enrichment, posture reporting, file hashing on uploads and downloads, and stronger anti-tampering protection.

View guidance for various MDM platforms below:

Enforcing Keep Aware with Group Policy​

To deploy Keep Aware through Group Policy, navigate to your domain controller Group Policy Management tool and review the following steps.

  1. Group Policy Object: Create a single Group Policy object for Keep Aware
  2. Administrative Template: Download and import Administrative Templates into your policy for browsers such as Google Chrome, Microsoft Edge, and Mozilla Firefox.
  3. Extension Configuration: Adjust the ExtensionInstallForcelist setting for the various browsers to the following identifier. This setting is often referred to as "force-installed" extensions or "silently-installed" extensions. 
    camnmdjjfkcplbdlofbndmkmnfeegjoi;https://clients2.google.com/service/update2/crx
  4. Tenant Configuration: Add Tenant Keys using New Registry Keys for ka_host and ka_start to each browser.

Uninstalling Keep Aware​

If you need to remove Keep Aware from Windows devices, you can uninstall it using the same deployment tools used for installation.

To silently uninstall Keep Aware through the MSI installer, use the following command:

msiexec.exe /qn /x "keepaware.msi"

Alternatively, you can uninstall using the product code:

Get-Package -Name "Keep Aware" | Uninstall-Package -Force

After uninstallation, devices and browsers will be marked as uninstalled on the Devices page. Uninstalled devices older than 90 days will be removed automatically.

Table of Contents