EPM Windows records a video of what happens on a workstation while an application runs, whether or not it runs with elevated privileges. It records every execution that the global parameter and an access policy with recording enabled allow. The agent sends each recording to the Segura® Platform, where administrators and auditors can review it. Session recording keeps a reviewable record of what users did in an application, with or without elevated privileges.
Key concepts
- Global parameter: the Enable recording session? parameter, which makes session recording available in the EPM Windows environment. It does not record anything by itself.
- Access policy recording setting: the Record session for these applications option in an access policy, which turns recording on or off for the applications in that policy.
- Recorded execution: one execution that EPM Windows recorded and sent to the Segura® Platform.
How it works
Enabling the global parameter does not start any recording. The parameter only makes session recording available. EPM Windows records an application only when an access policy that contains it has recording enabled.
Both settings are required:
- The global parameter must be enabled.
- The application must be part of an access policy that is enabled and has recording enabled.
If the global parameter is enabled and no access policy with recording enabled contains the application, EPM Windows records nothing.
| Global parameter | Application in an access policy with recording enabled | Result |
|---|---|---|
| Enabled | Yes | Recorded |
| Enabled | No | Not recorded |
| Disabled | Yes or No | Not recorded |
EPM Windows records only the following three types of execution:
- Any execution: applications.
- Just-in-time: the entire session, until the user logs off or cancels just-in-time access. All actions the user takes during the session are recorded and forwarded to the Segura® server, similar to a RunAs elevation.
- Automation: all automation carried out in the process.
Actions performed on network adapters and credential withdrawals are not recorded.
Starting with version 4.2.16, the EPM Windows agent records sessions as MP4 files with H.264 video encoding. Earlier agent versions record sessions in GUAC format. Segura® Platform 4.2.16 still accepts GUAC recordings from earlier agents as a fallback. The format change does not affect the recording settings. The 4.2.16 agent requires Segura® Platform 4.2.16 or later; more information in EPM version compatibility.
Key capabilities
- Evidence of user activity: a log shows that a user ran an application; the recording shows what the user did in it.
- Oversight of just-in-time access: just-in-time access opens a full privileged session, and the recording covers that session from start to end.
- Selective recording: access policies decide which applications are recorded, so you record what matters instead of every execution.
When to use it
- Audits: show an auditor exactly what a user did in an application on a workstation.
- Incident investigation: reconstruct the sequence of actions after a configuration change, an unexpected installation, or a suspected compromise.
- Accountability: keep a reviewable record of how users work with sensitive applications, including the ones they run with elevated privileges.
Security teams, EPM administrators, and auditors are the main users of session recordings.