Specifying the sessions to find

After you start Find Sessions by selecting View DirectAudit Sessions, from the Windows command line, or in a web browser, the program displays a graphical user interface for selecting search criteria. You can use the Common or Advanced search criteria to find sessions of interest. The Find Sessions dialog box then displays the results that match the criteria you specify. You can then replay, update the review status, display the list of indexed commands or events, copy session URI, or view the desktops used in any of the sessions returned.

In most cases, you can find the sessions you are interested in through some combination of user name, computer name, and session time displayed on the Common tab. If you right-click to View DirectAudit Sessions from a specific computer or user, that computer or user is automatically defined as the search criteria. If you want to specify additional criteria, such as review status or auditor name, you can click the Advanced tab.

To specify criteria by which to find sessions:

  1. Start Find Sessions.
  2. Select the desired installation from the Installation list.
  3. On the Common tab, enter the basic search criteria as applicable for the sessions you want to find:
    • User: Type all or part of the user name to find sessions for a particular user account.

    • Machine: Type all or part of the computer name to find sessions run on a particular computer.

    • Session start time: Select this option to find sessions based on when the session started. If you select this option, you can refine the search to include sessions started or not started in a specific number of days, hours, or minutes, or to include sessions started or not started today, yesterday, this week, last week, this month, last month, this year, or last year.

  4. Click Find Now to find the sessions that match the criteria you specified.

  5. Click Clear All to start a new query.