Watch, lock, or terminate a live session
The Live Session Viewer shows an active session as it happens. From the viewer you can lock the session to stop the user from working or terminate it. Use these actions when you see suspicious or unauthorized activity.
Before you begin
A session appears in the viewer only when the connection profile on its access policy has Record Proxy Session selected. You can watch only a user's current session live.
These people can use the viewer:
- Administrators.
- Users whose role includes the Live Session Viewer permission. This permission is available in the Auditors permission list. An Auditors role limits which sessions the user can watch with its Users and Resources scope tabs.
The Terminate Session and Lock Session permissions stay disabled until Live Session Viewer is turned on. See Roles and permissions and Create a custom role.
Open the Live Session Viewer
- Open the Active tile. See Manage active and scheduled sessions.
- Select the expand icon on the session's row. The row lists one entry for each sign-in, for example
RDP Session is live now. - Select the entry with the eye icon to open the viewer. If the entry has no icon, the session isn't being recorded or you don't have permission to watch it.
If the user signed in to the session more than once, the row lists several recordings. Select the current one.
Viewer types
The viewer depends on the protocol of the session.
| Viewer | Sessions |
|---|---|
| RDP | Remote Desktop sessions. The viewer shows the screen of the session. |
| SSH | SSH sessions. The viewer shows the terminal of the session. |
A website session has no live viewer. You can replay a website session after it ends. See Replay a recorded session.
Both viewers show these details in the header:
| Detail | Meaning |
|---|---|
| User | The account used to sign in to the resource |
| logged on to | The resource |
| using | The computer the session connects from |
| Activity | The name of the activity |
| Proxy Session Started | When the activity's actions began. This isn't when the user signed in to the resource. |
The RDP and SSH viewers also show a timeline of the session as it happens, in the pane to the left of the player. The timeline includes keystrokes. When the Record Keystrokes and Metadata setting of the connection profile is cleared, the session video is still recorded.
The RDP timeline also lists Windows events when the Remote Desktop Monitor service is installed on the target host. See Install the Remote Desktop Monitor.
Lock a session
Lock a session to stop the user from working without ending the session.
- In the viewer, select Lock. You can also select the session on the Active tile and select Lock Activity.
- In the Lock Session window, keep the Lock Title or replace it. For example,
Security review. - Keep or replace the Lock Message. For example,
Your session is locked while the security team reviews it. Contact the help desk. - Under Prevent User From:, select what to block:
- Opening new sessions on this activity
- Opening new activities to this resource
- Any further activity with this account (Unlock via Users & Groups)
- Select Okay.
The window opens with the title "Netwrix Privilege Secure" and the message "Your session has been temporarily locked, please see a Netwrix Privilege Secure administrator for more information." already filled in. Replace them with your own text. The user sees the title and message in the RDP or SSH client.
The first two options are selected when the window opens. The options build on each other. Selecting Opening new activities to this resource also selects Opening new sessions on this activity, and selecting Any further activity with this account selects both. When you lock from the Active tile, the window doesn't offer Opening new sessions on this activity.
To unlock the session, select Unlock in the viewer. You can also select the session on the Active tile and select Unlock Activity.
If you selected Any further activity with this account, the account stays locked after you unlock the session. Unlock the account from its details page: select Unlock Account, which replaces Lock Account while the account is locked. See User and group details.
Terminate a session
Terminate a session to disconnect the user at once.
- In the viewer, select Terminate Session.
- In the Terminate Proxy Session window, confirm the prompt "Are you sure?".
- (Optional) Select Cancel Activity Session to also cancel the activity session in Privilege Secure. The user can't sign in again through the same session.
- Confirm the termination.
For example, a user runs an unapproved script during a session. Select Terminate Session, select Cancel Activity Session, and confirm. The user is disconnected and can't reconnect through that session.
Terminating a session doesn't stop the user from requesting a new one. To block that, lock the user's account with Lock Account on the User and group details page.
A command restriction can also lock or end a session on its own. The Block And Lock and Terminate actions do this when a user runs a restricted command. See Restrict SSH commands.