Actions Captured When Auditing User Sessions
Review a full list of all session actions when auditing user sessions with Netwrix Auditor.
Object type | Action | What | Description |
---|---|---|---|
User session |
Session start |
Monitoring start |
|
Session start |
Local session start |
— |
|
Session end |
Sign-out |
|
|
Session end |
Shutdown |
|
|
Session start / Session end |
Screensaver off / Screensaver on |
— |
|
Session start / Session end |
Unlock / Lock |
— |
|
Session start |
Console connection |
|
|
Session end |
Console disconnection |
|
|
Session start |
Remote connection |
|
|
Session end |
Remote disconnection |
|
Run As Monitoring
Netwrix Auditor for User Activity can monitor programs executed under different user accounts. Review the table below to discover how different "run as" scenarios are reflected in the product.
Object type | Details | Description |
---|---|---|
Window |
None |
User runs application. |
Window |
Application Run As: <account_name> |
Standard user runs an application under credentials of another standard user. |
Elevated Window |
Application Run As: <account_name> |
User runs program through Run As Administrator or Accepts UAC (User Account Control) elevation prompts. |
Elevated Window |
None |
Administrator runs the program set to always Run as Administrator. For example, Server Manager. |