EmpowerID maintains real-time recordings and logs of user activity for each RDP or SSH session initiated by Privileged Session Manager. Computer Credential Access Managers (owners) and other delegated administrators can view these logs and recordings as needed, and when necessary, terminate an active session with the click of a button.
To view privileged session details
From the navigation sidebar of the EmpowerID Web interface, navigate to the Find Computer page by expanding Resources and clicking Computers.
From the Find Computer page, click the RDP/SSH Sessions tab and then search for the session you want to view. You can search by computer name, DNS host name, the Display Name of the EmpowerID Person using the session, or the Login of the EmpowerID Person using the session.
Click the Session Details button for the session.
This directs you to the View One page for the session. This page allows you to view details about a given session including who initiated the session, the computer accessed through the session, as well as playback controls for viewing a recording of what the user did during the session and a log of the keystrokes they made.
To play a recording of the screenshots taken by EmpowerID during the session, click the Play button on the screen. Once playback begins, you can click on the screen to pause and play the recording as needed, as well as adjust the playback speed using the Speed slider.
To navigate to a specific screenshot, click the thumbnail pertaining to that screenshot.
To view a transcript of the keystrokes performed by the user during the session, navigate to the Session Transcript section of the page.
You can search for specific words or characters that may have happened in a session by typing those words in the Search field above the transcript logs and pressing ENTER.