With native auditing, you need to run a standalone tool each time you want to record user activity on a specific workstation.
- Run PSR.exe (Steps Recorder) and click "Start Record".
- Perform the necessary changes and click "Stop Record".
- Click "Save As", select the path where you want to save recorded data and click "save".
- To view the changes made open the given mht file in Internet Explorer and see screenshorts with all your actions.
With Netwrix Auditor, you need to enable video recording just once to monitor a particular computer or a group of computers, and then you can review records for any time period you want.
- To enable video recording for a particular workstation, run Netwrix Auditor. → Click “Add Plan”. → Select “User Activity”. → Click "Next". → Specify the account for collecting data. → Click "Next". → Leave the default SQL Server settings and click "Next". → Specify the monitoring plan name. → Click "Finish". → Specify the computer you want to monitor and its IP address or FQDN. → Click "Add".
To view a video record, navigate to Reports | Windows Server | User Activity. → Select "All User Activity". → Click "View". → Specify the "From:" and "To:" dates. → Click "View Report". → Click on the desired time to play the video.
Spot and investigate unauthorized changes with video recording of user activity
Privileged users have the ability to make changes that can lead to unavailability of critical systems and security breaches. Therefore, it’s essential to keep privileged users accountable by monitoring their activity in critical systems and applications. One of the most effective options is video recording which enables IT pros to watch privileged users’ activity. Video recordings can provide valuable insight into the activity of privileged users, and knowing that activity is being recorded can deter users from making unauthorized changes.
Netwrix Auditor for Windows Server delivers complete visibility into Windows Server changes by providing key details about each change, including the before and after values. It also provides video recording of user screen activity to deliver deep visibility into the activity of privileged users across critical systems— even systems that do not produce any logs. IT admins can search and replay the recording to drill down into details and ensure no activity goes unnoticed. This feature is invaluable for investigating the root cause of a security issue.