That's exactly how I have KeePass configured on Windows 10. I've set my keyfile (additional entropy for the encrypted password DB, combined with master password

That's exactly how I have KeePass configured on Windows 10. I've set my keyfile (additional entropy for the encrypted password DB, combined with master password) access to only allow the Admin account. Then, I set keepass.exe to always run as Admin, which of course prompts the UAC whenever it is launched. This actually accomplishes a few things: * The keyfile is safe from processes launched using the standard user account (i.e. non-elevated). Malware accidentally launched by 'me' can't read it. * Keepass.exe is running in the admin process space, which protects its memory from processes running in non-elevated space. * Launching admin-space Keepass, and seeing the UAC prompt, Microsoft includes information about how the exe is signed -- which Keepass is -- that allows me to verify every time that I'm not launching a bogus keepass.exe. * The password database file is still in user-land, so it can be synced with standard cloud sync tools. It is worthless without the keyfile though, even if my master pass ever slipped.