You are here: Administration — Monitored actions, object types and attributes — User Sessions

Actions Captured When Auditing User Sessions

Review a full list of all session actions when auditing user sessions with Netwrix Auditor.

Object type	Action	What	Description
User session	Session start	Monitoring start	Logon (session creation) Start of monitoring (after service install or deploy)
	Session start	Local session start	—
	Session end	Sign-out	User initiated sign-out / logoff
	Session end	Shutdown	Computer shutdown Service stop / crash (appears after one starts service again)
	Session start / Session end	Screensaver off / Screensaver on	—
	Session start / Session end	Unlock / Lock	—
	Session start	Console connection	Connect locally to existing session
	Session end	Console disconnection	Switch user Remote connect to existing session
	Session start	Remote connection	Connect through RDP
	Session end	Remote disconnection	Disconnect in RDP or just close RDP session

Run As Monitoring

Netwrix Auditor for User Activity can monitor programs executed under different user accounts. Review the table below to discover how different "run as" scenarios are reflected in the product.

Object type	Details	Description
Window	None	User runs application.
Window	Application Run As: <account_name>	Standard user runs an application under credentials of another standard user.
Elevated Window	Application Run As: <account_name>	User runs program through Run As Administrator or Accepts UAC (User Account Control) elevation prompts.
Elevated Window	None	Administrator runs the program set to always Run as Administrator. For example, Server Manager.

Corporate Headquarters: 300 Spectrum Center Drive, Suite 200 Irvine, CA 92618

Phone: 1-949-407-5125 | Toll-free: 888-638-9749