Session Recordings
GrantFlow can record RDP and SSH sessions as video. A recording shows the session's screen or terminal as the user saw it, and is kept as compliance evidence: once stored, nobody can delete or alter it before its retention ends, administrators included. Watching a recording is a right you grant explicitly, and every playback is recorded in the audit log with a reason.
To set up zones and targets first, see Remote Sessions Setup and Session Targets.
What Is Recorded
A target records its sessions when Record sessions is on in its dialog, which is the default for new and imported targets. The REC badge on the users' Sessions page and Recorded on the admin RDP and SSH tabs show which targets record.
Before a recorded session opens, the user sees a notice: that the session is recorded to video, how long the recording is kept, that only people your tenant has granted the right may watch it, and what the session allows for clipboard, file transfer and audio. The user connects only after acknowledging it. A user can choose not to see the notice again on that device.
A recording captures what appears on the screen. It does not log keystrokes, so a password typed into a masked field leaves no trace in it. Anything visible is captured, though: a credential echoed in a terminal, passed on a command line, or shown in plain text by an application is in the video. Treat recordings as potentially containing secrets, and ask users not to reveal credentials on screen. File transfers and SSH file browsing do not appear in the video. Each transferred file is logged in the audit log instead, as described in Session File Transfer.
GrantFlow saves a recording to tamper-proof storage in parts while the session runs. A recording appears on the Recordings tab once its session has ended and it has been stored.
Who May Watch Recordings
Administering GrantFlow and watching someone's session are different mandates, so admin rights do not include playback. You choose the viewers under Admin → Sessions → Overview, in the Session & Recording Settings section:
| Setting | What it does |
|---|---|
| Recording viewers | Users who may play back any recording, up to 50. A viewer may also watch their own sessions. |
| Recording viewer groups | Directory groups whose direct members hold the same right, up to 20 groups. Members of nested groups and AD primary-group membership, such as Domain Users, do not count. Membership follows the directory sync. |
| Approver access | When on, an approver may play back recordings of activations they approved themselves, and nothing else. Off by default. |
Click Save to apply. Until at least one viewer exists, the Overview's setup checklist reports that targets record and nobody may watch the recordings.
A user who is the subject of a session cannot watch it through approver access. The only way to watch your own session is to be a recording viewer.
Retention
Recordings are kept for 90 days by default. You can set the tenant default in Retention (days) in the same settings section, from 30 to 365 days. A zone can override it with Recording retention (days) in the zone dialog, within the same range.
A recording keeps the retention that applied when its session started. Its storage is locked until that date, so it cannot be deleted early. After the date, GrantFlow deletes the recording automatically, within about an hour. Changing the retention affects new sessions, not recordings that already exist.
The Recordings Tab
Admin → Sessions → Recordings lists the stored recordings of your tenant, with a filter by zone. For each recording you see the target with its host and port, the user, when the session ended, when its retention ends (Retained until), and whether a legal hold applies (Hold). Every admin sees the list, but only someone allowed to watch a recording can play it back.
Legal Holds
A legal hold keeps a recording beyond its retention, for example during an investigation. To place one, click the Place a legal hold icon on the recording's row, enter a reason of 10 to 500 characters, and confirm. Retained until then reads Held indefinitely, and the recording is not deleted while the hold stands.
To end the hold, click the Release the legal hold icon and enter a reason again. Releasing a hold is the decision that lets evidence be deleted, so it needs a reason as well. Once released, the recording is deleted when its retention ends, or soon after release if that date has already passed. Only tenant admins can place or release a hold.
Play Back a Recording
On the Recordings tab, click the Play back icon on a recording. Before any frame is shown, GrantFlow asks you to state a reason:
- Enter the Reason for viewing this recording, between 10 and 500 characters, for example Reviewing the change made during incident INC-4821.
- Click Start playback.
The reason is written to the audit log, with your name and the session, before playback begins. If you may not watch this recording, GrantFlow refuses playback and records the attempt as well.
The player streams the recording. Use Play and Pause, and drag the timeline to jump to any point. The clock shows the current position and the total length. A recording cannot be downloaded, and nothing is saved on your computer. Click Back to Recordings to return to the list.
Partial recordings
If a recording ends before its session did, the player says so. This happens when the part of GrantFlow that recorded the session stopped before it could finish the recording. The recording then holds everything up to that point.
Viewers who are not tenant admins cannot open the Recordings tab. They can still play a recording back through a direct link to its playback page, such as one an admin sends them.
Audit Events
Recordings and their settings create these audit events:
| Event | When |
|---|---|
| Recording Viewed | Someone asked to play a recording back, with their reason and why they were allowed. A refused attempt is recorded too. |
| Recording Stored | A session's recording was stored. |
| Recording Linked, Recording Completed | GrantFlow attached a stored recording to its session after a delay, or a recording first stored as partial became complete. |
| Recording Legal Hold Set, Recording Legal Hold Cleared | A legal hold was placed or released, with the reason. |
| Recording Expired | A recording was deleted at the end of its retention. |
| Session Settings Updated | The retention, viewers, viewer groups or approver access were changed. |
For the full list of audit events, see Audit Events.