User Activity

Enable monitoring of the selected data source and configure Netwrix Auditor to collect and store audit data.

You can enable the message that will be displayed when a user logs in and specify the message text.

When enabled, the product records video in addition to user sessions events collection. This option is disabled by default.

NOTE: For these settings to become effective, enable video recording on the General tab.

Optimize video file by adjusting the following:

• File size and video quality
• Save video in grayscale
• CPU load and Video smoothness.

Limit video file length by adjusting the following:

• Recording lasts for <...> minutes—Video recording will be stopped after the selected time period.

• User has been idle for <...> minutes—Video recording will be stopped if a user is considered inactive during the selected time period.

  NOTE: If the Record video of user activity within sessions option is enabled, the User Sessions report shows active time calculated without including user idle period. Mind that a computer is considered to be idle by Windows if there has not been user interaction via the mouse or keyboard for a given time and if the hard drives and processors have been idle more than 90% of that time.

• Free disk space is less than <...> MB—Video recording will be stopped when upon reaching selected disk space limit.

• Consider user activity — Select one of the following:

  • Stop if user has been idle for <...> minutes. Select if you want video recording for a user to be stopped after the specified time period.
  • Continue video recording regardless of the user idle state. When selected, Netwrix Auditor continues video recording for idle users.

When the selected retention period is over, Netwrix Auditor deletes your video recordings.

Select the users whose activity should be recorded. You can select All users or create a list of Specific users or user groups. Certain users can also be added to Exceptions list.

Select the applications that you want to monitor. You can select All applications or create a list of Specific applications. Certain applications can also be added to Exceptions list.

To create a list of inclusions / exclusions, click Add and enter application title and description as follows:

• Title – provide an application title as shown in the header of the window you want to exclude / include.

  NOTE: This value will be shown in the "What" column of reports and search results, for example, Document1.txt - Notepad.

• Description – provide an application description as shown in the Details column of the Task Manager snap-in.

   

NOTE: Wildcards (*?) are supported. See the examples below for more information.

Examples:

The following examples explain how the exclusion rules work.

NOTE: Same logic applies to the inclusion rules.

1. Exclude the Notepad application window called, for example, "Document1".

   • Provide the Title filter as shown in the application window – the value must be "Document1.txt - Notepad":

     

   • Provide the Description filter – the value must be "Notepad".

     

     To find the description, start the Task Manager snap-in, locate the desired application and review description in the Details column.

     NOTE: If you cannot find the Description column, right-click any available column name, then click Select columns and tick the required one.

2. Exclude applications using wildcards.

   • * - Notepad (the "Title" filter) will exclude all Notepad windows.
   • colo?r * (the "Title" filter) will exclude all windows containing "color" or "colour".