EmpowerID maintains real-time recordings and logs of user activity for each RDP or SSH session initiated by the Privileged Session Manager. Computer Credential Access Managers (owners) and other delegated administrators can view these logs and recordings as needed, and when necessary, terminate an active session with the click of a button.
To view privileged session details
- In the navigation sidebar of the EmpowerID Web interface, expand Resources and click Computers.
From the Find Computer page, click the RDP/SSH Sessions tab and then search for the session you want to view.
You can search by any of these parameters:
- computer name
- DNS host name
- the Display Name of the EmpowerID Person using the session
- the Login of the EmpowerID Person using the session
- Click the Session Details button for the session.
This directs you to the View One page for the session. This page lets you view details about the session, such as:- who initiated the session
- the computer accessed through the session
- a recording of what the user did during the session
- a log of the keystrokes made during the session
- To play a recording of the screenshots taken by EmpowerID during the session, click the Play button on the screen. Once playback begins, you can click the screen to pause and play the recording, and adjust the playback speed using the Speed slider.
- To navigate to a specific screenshot, click the thumbnail of that screenshot.
- To view a transcript of the keystrokes performed by the user during the session, scroll to the Session Transcript section of the page.
- To search for specific words or characters in a session, enter them in the Search field above the transcript logs and press ENTER.
