Actions Captured When Auditing User Sessions

Review a full list of all session actions when auditing user sessions with Netwrix Auditor.

Object type Action What Description
User session

Session start

Monitoring start
  • Logon (session creation)
  • Start of monitoring (after service install or deploy)

Session start

Local session start

—

Session end

 Sign-out
  • User initiated sign-out / logoff

Session end

Shutdown
  • Computer shutdown
  • Service stop / crash (appears after one starts service again)

Session start / Session end

Screensaver off / Screensaver on

—

Session start / Session end

 Unlock / Lock

—

Session start

Console connection

  • Connect locally to existing session

Session end

Console disconnection

  • Switch user
  • Remote connect to existing session

Session start

Remote connection

  • Connect through RDP

Session end

Remote disconnection

  • Disconnect in RDP or just close RDP session

Run As Monitoring

Netwrix Auditor for User Activity can monitor programs executed under different user accounts. Review the table below to discover how different "run as" scenarios are reflected in the product.

Object type Details Description

Window

None

User runs application.

Window

Application Run As: <account_name>

Standard user runs an application under credentials of another standard user.

Elevated Window

Application Run As: <account_name>

User runs program through Run As Administrator or Accepts UAC (User Account Control) elevation prompts.

Elevated Window

None

Administrator runs the program set to always Run as Administrator. For example, Server Manager.