Admin Configuration

The admin configuration allows device or system administrators to define environment properties for Cryptomator so it runs in the desired context for all users on a device. It is a system-level key-value file that persists across updates.

Location of the Admin Configuration

note

Editing the admin configuration may require elevated privileges (i.e. admin or root permissions).

The storage location of the admin configuration file config.properties depends on the OS. The following table shows the storage path for each OS:

OS	Default Path
Windows	C:\ProgramData\Cryptomator\config.properties
macOS	/Library/Application Support/Cryptomator/config.properties
Linux	/etc/cryptomator/config.properties

Editing the Admin Configuration

The admin configuration is a simple, UTF-8 encoded key-value file. Entries are of the form property-key=property-value.

info

Backward slashes \ in property values must be escaped with another \. For example, setting a value of C:\Logs\Cryptomator has to be entered as C:\\Logs\\Cryptomator.

Example: To allow loading of external plugins, you have to set cryptomator.pluginDir to a directory of your choice. If you want to set it to ~/cryptomator/plugins, the line in the admin file looks like this:

cryptomator.pluginDir=@{userhome}/cryptomator/plugins

warning

After creating/editing the file, ensure correct file access permissions!

We recommend read access for all users, write access only for system/device admins. On Windows, Cryptomator enforces this and ignores the file otherwise, see File Permissions on Windows.

File Permissions on Windows

Since Cryptomator 1.19.5, the admin configuration is only loaded on Windows if it cannot be edited by standard users. Cryptomator checks the following requirements on every start and ignores the admin configuration if any of them is not met:

• config.properties, its directory and all parent directories up to the drive root are owned by SYSTEM, Administrators or TrustedInstaller.
• No other user or group has permissions to modify the file (meaning write, append, delete, change permissions, take ownership) or to delete or replace one of the directories (delete, delete subfolders and files, change permissions, take ownership). Permissions to create new files in a directory are fine.
• The path does not contain junctions or symbolic links.

If the admin configuration is ignored, the application log contains a warning starting with Ignoring admin config. The warning logged right before it names the concrete cause, e.g. the path and its untrusted owner, the modifying rights granted to an untrusted principal, or the link a path element resolves to.

During installation (including repair and upgrade) the installer sets up the directory C:\ProgramData\Cryptomator and, if no admin config exists, places an empty config.properties with correct permissions inside it.

An existing config.properties is left untouched, including its owner and permissions. To replace it with one the installer creates, proceed as follows with elevated privileges:

1. Rename C:\ProgramData\Cryptomator\config.properties, e.g. to config.properties.old.
2. Repair the installation, e.g. by running the Cryptomator installer again and choosing Repair. This secures the directory and places a new, empty config.properties with correct permissions inside it.
3. Copy the entries you need from the renamed file into the new config.properties and delete the renamed file afterwards.

warning

Before copying entries, review the content of the renamed file for unexpected values, especially cryptomator.pluginDir.

For verification, run the following commands in PowerShell:

(Get-Acl "C:\ProgramData\Cryptomator").Sddl
(Get-Acl "C:\ProgramData\Cryptomator\config.properties").Sddl

Each command prints owner and permissions in SDDL form. For a configuration created by the installer, the output is:

O:BAG:SYD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;BU)
O:SYG:SYD:AI(A;ID;0x1200a9;;;BU)(A;ID;FA;;;BA)(A;ID;FA;;;SY)

SY stands for SYSTEM, BA for Administrators and BU for Users; TrustedInstaller has no abbreviation and appears as its full SID. FA grants full access, 0x1200a9 read and execute. The installer-generated defaults have the following characteristics:

• The owner (O:) is SY, BA or S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 (TrustedInstaller).
• The permissions after D: consist of exactly three entries, one each for SY, BA and BU (order may differ).
• The directory's permissions contain the P flag (D:PAI).
• The file's entries carry the ID flag.

A deployment tool that creates the admin config must meet the ownership, access and link restrictions described above; it does not need to reproduce the installer's ACLs exactly.

Configurable Properties

The following property keys are supported.

Property Key	Description
cryptomator.logDir=[DirPath]	The directory where Cryptomator stores its log files (e.g. application log, migration log).
cryptomator.pluginDir=[DirPath]	The directory where Cryptomator discovers plugins.
cryptomator.p12Path=[FilePath]	The path to the device key.
cryptomator.mountPointsDir=[DirPath]	The directory where Cryptomator mounts vaults if no per-vault location has been set.
cryptomator.disableUpdateCheck=[Boolean]	Whether to disable automatic update checks (true) or allow them (false). Defaults to false.
cryptomator.hub.allowedHosts=[UrlList]	List of hosts that Cryptomator is allowed to connect to during Hub unlock. List entries are comma separated and each host url consists of scheme:host:port (port is optional). For example https://hub1.example.com,https://hub2.example.com:4432
cryptomator.hub.enableTrustOnFirstUse=[Boolean]	Whether Cryptomator shall ask the user to trust unknown Hub hosts (true) or disallow connection attempts (false). A Hub host is considered unknown unless it is well-known (*.cryptomator.cloud), listed in cryptomator.hub.allowedHosts, or has already been allowed by the user. Defaults to true

Substitutions

Substitutions are used to dynamically resolve the content of some properties depending on the environment Cryptomator is started in, e.g. by inserting the path to the user's home folder. They may only be used in properties that start with cryptomator. (mind the dot) like cryptomator.logDir. All occurrences of the following substitution keys – in supported properties – are replaced by their respective variable values:

Substitution Key	Variable Value
@{appdir}	The application installation directory.
@{appdata}	%APPDATA% (Windows only).
@{localappdata}	%LOCALAPPDATA% (Windows only).
@{userhome}	The user's home directory.

Unknown substitution keys remain unchanged; a key without a value is replaced with an empty string.