Auditing captures user activity

After you deploy audit and monitoring service, the Centrify Agent for Windows captures all of the user activity on the computers you choose to audit. Depending on whether you enable identity and privilege management together with audit and monitoring service, or just audit and monitoring service on a computer, the agent starts recording user activity when a user selects a role or logs on to a computer and continues recording until the user logs out or the computer is locked because of inactivity. If you enable identity and privilege management together with audit and monitoring service on a computer, the agent records user activity when a role withaudit and monitoring service is used. If you only enable audit and monitoring service on a computer, all user activity is captured by default.

Each record of continuous user activity is called a session, and starts as soon as users log on, whether they log on locally, using a Windows Remote Desktop connection, through a virtual network connection such as Citrix or VNC, or using any other type of remote access software. A session ends when the user logs out, disconnects, or is inactive long enough to lock the desktop. If the user reconnects to a disconnected desktop or unlocks the desktop, the agent resumes recording the user’s activity as a new session. Each session is a video record of everything that takes place on the user’s desktop during a period of user activity.