Configuration

Cascading Configuration


KeePass uses cascading configuration files for maximum configurability and adaptivity.

KeePass supports two different locations for storing configuration information: the global configuration file in the KeePass directory and a local, user-dependent one in the user's private configuration folder. The first one is called global, because everyone using this KeePass installation will write to the same configuration file (and possibly overwriting settings of other people); the other one is called local because changes made to this configuration file only affect the current user.

Configuration files are KeePass.ini, stored in INI format.

"Global Configuration File" means the configuration file in the application directory (where KeePass.exe is located).

Generally, KeePass will prefer the global configuration file. Only if reading/saving configuration items fails, the local one will be used. KeePass does the following when loading/saving the configuration:


Text  Installation by Administrator, Usage by User

If you use the KeePass installer and install the program with administrator rights, the program directory will be write-protected when working as a normal user. That means that KeePass saves your options into your users directory, but loads them from the global configuration file.

If you want KeePass to use only the users directory (i.e. not loading the configuration from the global configuration file), logon to Windows with administrator rights and delete the global configuration file in the program directory. This forces KeePass to use the local configuration in the users directory for both reading and writing when logging on as normal Windows user (without admin rights), because users don't have write access to the program directory.


Text  For Network Administrators

All settings in the global configuration file override the settings of the users. That means that you can selectively force some options, but leave other options to the users. For this, open the global configuration file on the network drive and have a look at it. Delete all entries that you want to leave up to the user (don't just set it to nothing, delete the line completely!).

The options you set in the global configuration are enforced for all users, all other options are configurable by the users (they are written to the local configuration in the users directory). Make sure you write-protect the global configuration on the network drive so nobody can overwrite it.

This method of course only is effective as long as your users use the KeePass installation on the network drive. If they copy KeePass to their harddrives and run it from there, the options you set are not enforced (the local KeePass installation doesn't know anything of the configuration file on the network drive in this case).