KeePass   KeePass Help Center Home KeePass Home | Package Downloads | Flag Translations | Blocks Plugins | Donate Donate  
Home Help Center Home | People Forums | Award Awards | Link Links | Search Search  







Configuration

Configuration


Details about how and where KeePass stores its configuration.

KeePass supports multiple locations for storing configuration information: the global configuration file in the KeePass application directory, a local user-dependent one in the user's private configuration folder, and an enforced configuration file in the KeePass application directory. The first one is called global, because everyone using this KeePass installation will write to the same configuration file (and possibly overwriting settings of other users). The second one is called local, because changes made to this configuration file only affect the current user.

KeePass 1.x Only
Configuration files are stored in INI format.

ConfigurationLocationTypical File Path
Global Application Directory C:\Program Files (x86)\KeePass Password Safe\KeePass.ini
Global (Virtualized) Windows Vista/7/8 Virtual Store C:\Users\User Name\AppData\Local\VirtualStore\Program Files (x86)\KeePass Password Safe\KeePass.ini
Local User Application Data C:\Users\User Name\AppData\Roaming\KeePass\KeePass.ini
Enforced Application Directory C:\Program Files (x86)\KeePass Password Safe\KeePass.enforced.ini

KeePass 2.x Only
Configuration files are stored in XML format.

ConfigurationLocationTypical File Path
Global Application Directory C:\Program Files (x86)\KeePass Password Safe 2\KeePass.config.xml
Global (Virtualized) Windows Vista/7/8 Virtual Store C:\Users\User Name\AppData\Local\VirtualStore\Program Files (x86)\KeePass Password Safe 2\KeePass.config.xml
Local User Application Data C:\Users\User Name\AppData\Roaming\KeePass\KeePass.config.xml
Enforced Application Directory C:\Program Files (x86)\KeePass Password Safe 2\KeePass.config.enforced.xml

On 32-bit systems, the name of the program files folder is 'Program Files' instead of 'Program Files (x86)'.


Text  Installation by Administrator, Usage by User

If you use the KeePass installer and install the program with administrator rights, the program directory will be write-protected when working as a normal/limited user. KeePass will use local configuration files, i.e. save and load the configuration from a file in your user directory.

Multiple users can use the locally installed KeePass. Configuration settings will not be shared and can be configured individually by each user.


Text  Portable Version

If you downloaded the portable version of KeePass (ZIP package), KeePass will try to store its configuration in the application directory. No configuration settings will be stored in the user directory (if the global configuration file is writable).


Text  Create Portable Version of Installed KeePass

If you are currently using a locally installed version of KeePass (installed by the KeePass installer) and want to create a portable version of it, first copy all files of KeePass to the portable device. Then get the configuration file from your user directory (application data, see above) and copy it over the configuration file on the portable device.


Text  For Network Administrators: Enforced Configuration

KeePass can be forced to load specific configuration settings. Enforced configuration settings are loaded from KeePass.enforced.ini (KeePass 1.x) and KeePass.config.enforced.xml (KeePass 2.x) files in the application directory (where KeePass.exe is stored).

Configuration items that are not present in the enforced configuration file are loaded normally from global/local configuration files.

Example (2.x). The following KeePass.config.enforced.xml file enforces the values/states of the settings 'Clipboard auto-clear time (seconds)', 'Lock workspace when minimizing main window' and 'Lock workspace when locking the computer or switching the user'. All other settings can be configured by the user.
<?xml version="1.0" encoding="utf-8"?>
<Configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:xsd="http://www.w3.org/2001/XMLSchema">
	<Security>
		<WorkspaceLocking>
			<LockOnWindowMinimize>true</LockOnWindowMinimize>
			<LockOnSessionSwitch>true</LockOnSessionSwitch>
		</WorkspaceLocking>
		<ClipboardClearAfterSeconds>20</ClipboardClearAfterSeconds>
	</Security>
</Configuration>
Enforced Options

UI disabled. KeePass 2.x disables most user interface items that are enforced. This can be seen in the screenshot for the example above: the enforced settings are drawn using gray text and clicking on them has no effect.

Security. Users must not have write access to the enforced configuration file (otherwise they could modify it, e.g. using a text editor).

Furthermore, this method only is effective as long as your users run the KeePass installation on the network drive. If they copy KeePass to their hard drives and run it from there, the options you set are not enforced (the local KeePass installation doesn't know anything of the enforced configuration file on the network drive in this case).

KeePass 2.x Only
All data nodes (leaf nodes) are optional, however preceding non-leaf nodes with the same tag name in parent nodes of data leafs that you want to enforce are mandatory. For example, to enforce hiding user names and passwords using asterisks by default, the enforced configuration file would look like the following:
<?xml version="1.0" encoding="utf-8"?>
<Configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:xsd="http://www.w3.org/2001/XMLSchema">
	<MainWindow>
		<EntryListColumns>
			<Column />
			<Column>
				<Name>UserName</Name>
				<HideWithAsterisks>true</HideWithAsterisks>
			</Column>
			<Column>
				<Name>Password</Name>
				<HideWithAsterisks>true</HideWithAsterisks>
			</Column>
		</EntryListColumns>
	</MainWindow>
</Configuration>
In this example, the empty <Column /> non-leaf node (representing the title field) has the same tag name as the following sibling nodes ("Column"), and therefore is required.


Text  Technical Details

This section explains in detail how loading and saving the configuration works.

When KeePass starts up and finds both global and local configuration files, it must decide the order in which KeePass tries to get the configuration items. This is controlled by the (Kee)PreferUserConfiguration flag in the global configuration file. If it is not present, it defaults to false.

The flag is set to true in the global configuration file of the KeePass installer package. The portable ZIP package does not contain a configuration file, consequently the flag defaults to false.

KeePass 1.x Only
Loading:
  • Try to get the configuration item from the enforced configuration file. If found, use this one.
  • If the item is neither present in the global configuration file nor in the local one: use default value.
  • If the item is present in the global configuration file, but not in the local one: use item from global configuration.
  • If the item is present in the local configuration file, but not in the global one: use item from local configuration.
  • If the item is present in the global and the local configuration file:
    • If the KeePreferUserConfiguration flag is True, use the item from the local configuration file, otherwise use the one of the global one.
Saving:
  • If the KeePreferUserConfiguration flag is True, try to store the configuration item into the local configuration file. If this fails, try to store the item into the global configuration file. If this fails, report error.
  • If the KeePreferUserConfiguration flag is False, try to store the item into the global configuration file. If this fails try to store the item into the local configuration file. If this fails, report error.

KeePass 2.x Only
Loading:
  • Try to get the configuration item from the enforced configuration file. If found, use this one.
  • If the PreferUserConfiguration flag is true, use the item from the local configuration file, otherwise use the one of the global one. If the global one doesn't exist or doesn't contain this item, use the default value.
Saving:
  • If the PreferUserConfiguration flag is true, try to store all configuration items into the local configuration file. If this fails, try to store them into the global configuration file. If this fails, report error.
  • If the PreferUserConfiguration flag is false, try to store all items into the global configuration file. If this fails try to store them into the local configuration file. If this fails, report error.








Valid XHTML 1.0 Transitional Document

Get KeePass

Flattr this


KeePass is OSI Certified Open Source Software
Copyright © 2003-2014
Dominik Reichl, [Legal Contact / Imprint] [Disclaimer] [Acknowledgements] [Donate], Downloads hosted at

Get KeePass Password Safe at
SourceForge.net. Fast, secure and Free Open Source software downloads