Desktop Surveillance Help

Transcription

1 Desktop Surveillance Help

2 Table of Contents About... 9 What s New System Requirements Updating from Desktop Surveillance 2.6 to Desktop Surveillance Program Structure Getting Started Deployment Process Working with Application Server and Database About Database Types Comparison Installing/Uninstalling/Updating the Server Installing the Server Adding Server Executable to Windows Firewall Using an External/Cloud-Based Server Computer Updating the Server Uninstalling the Server Server Tray Database Management About Database Cleanup Shrinking MS SQL Database Firebird Database Optimization Deleting the Client Moving the Server Database Management Tool About Management Tool Installation Prerequisites Prerequisites Overview Turning on Internet Information Service (IIS) Turning on IIS for Windows Vista, Windows 7 and Windows Turning on IIS for Windows Server 2008 and Windows Server 2008 R Turning on IIS for Windows Server

3 Installing.NET Framework Configuring Internet Information Service (IIS) Using Certificates Generating Self-Signed Certificate Exporting Self-Signed Certificate Importing Trusted Certificate Adding Certificate to Trusted Root Certification Authorities Setting HTTPS Binding for a Default Web-Site Installing/Uninstalling/Updating the Management Tool Installing the Management Tool Adjusting Computer for Remote Access Updating Management Tool Uninstalling Management Tool Opening Management Tool Management Tool Interface Changing Password for Logged in User Licensing General Licensing Information About Subscription Viewing License State Activating Serial Keys Online Adding Activated Serial Keys Offline Deactivating Serial Keys Client License Management User and User Group Management About Viewing Users and User Groups User Management Adding Users Editing Users Deleting Users User Group Management Adding User Groups Editing User Groups Deleting User Groups Permissions

4 About Permissions Administrative Permissions Client Permissions Permission Example Clients About Monitoring via Clients Installing the Clients About Client Installation Setting up Environment for Remote Installation Client Installation Prerequisites Disabling Simple File Sharing in Windows XP Disabling Sharing Wizard in Windows 7, Windows 8 and Windows Checking System Services Setting up Windows Server 2003, Windows XP, and Windows Vista Firewall Setting up Firewall for Windows Server 2008, Windows Server 2012, Windows 7, 8, and Installing Clients Remotely via the Management Tool About Selecting Computers Remote Client Installation Process Remote Installation From an Existing.INI File Installing Clients Locally About Client Installation Package Generating Client Installation Package Installing Clients Locally with Custom Monitoring Parameters Downloading Client Installation File (.exe) Installing Clients Locally without.ini File Installation via Third Party Software Cloning a Virtual Machine with Installed Client Updating Clients Reconnecting Clients to Another Server Uninstalling the Clients About Client Uninstallation Client Uninstallation Key

5 Uninstalling the Clients Remotely Uninstalling the Clients Locally Viewing Clients Client Description Client Configuration About Protected Mode Parameter Screen Capture Creation Parameters Keystroke Logging Parameters Monitoring Log Parameter URL Monitoring Parameters Application Filtering Parameters Forced User Authentication Parameter Additional Message on User Login Parameter Editing Client Configuration Viewing Client Configuration Defining Client Configuration for All Clients in a Group Client Group Management About Client Groups Adding Client Groups Editing Client Groups Deleting Client Groups Forced User Authentication on Client About Enabling Forced User Authentication on Client Granting the User Permission to Log In Logging In Additional Message on User Login About Enabling Displaying Additional Message Logging In Alerts About Alerts Viewing Alerts Alerts Management Adding Alerts

6 Rules Rule Examples Enabling/Disabling Alerts Editing Alerts Assigning Alerts to Clients Deleting Alerts Defining Global Alert Settings Alert Notifications About Monitor Tray Tray Notifications Journal Advanced Reports About Report Types Scheduled Reports About Adding Report Rules Editing Report Rules Deleting Report Rules Generating Reports from the Scheduled Report Rule Frequency and Time Interval for Report Creation Viewing Logs Report Generator About Report parameters Generating Report Creating a Scheduled Report Rule from the Report Generator Page System Configuration Defining Sending Settings Monitor About Installing/Uninstalling/Updating the Monitor Installing the Monitor Updating the Monitor Uninstalling the Monitor Working with the Monitor Running the Monitor

7 Changing the User in the Monitor Monitor Interface Monitor Interface Main Menu Panes Viewing Monitored Data Viewing Screen Captures Viewing Live Sessions Viewing URL Addresses Viewing Keystrokes Viewing Sessions of Clients with Enabled Forced User Authentication Receiving Information on Alert Events Search About Searching Quick Search Parameterized Search Parameterized Search Parameters Saving Search Parameters Restoring Search Parameters Examples of Search Parameters Moving Between Search Results in Session Reports About Reports Search Results Report Session Activity Report Exporting Video Saving Screen Captures Troubleshooting Database/Server Database/Server Related Issues Database/Server Related Error Messages Management Tool Management Tool Related Issues Management Tool Error Messages Monitor Monitor Related Issues

8 Monitor Error Messages Client Checking that the Client Is Installed Clients Installation/Uninstallation Issues and Error Messages Possible Problems with Receiving Data from Clients

9 About Welcome to Desktop Surveillance! Desktop Surveillance is an application that allows you to record the activity of the target computers with installed Clients and to view the screen captures from these computers in the form of video. 9

10 What s New Desktop Surveillance v. 3.2 introduces the following changes: Advanced Reports Generation: The feature allows an investigator to generate reports via the Management Tool. The reports contain information on user activity (including alert events) and visited URLs in different formats: grid report (the list of all alerts), summary reports (information on the time spent in each application/on each URL), and chart reports (summary reports in the bar chart and pie chart format). Scheduled Reports Generation: This feature allows generating reports of selected types by scheduler (daily, weekly, or monthly) and sending them to the required addresses. Displaying a Message on User Login: This feature allows displaying an information message with custom text on the user login. The user has to read the message text and click I Agree to start working with Windows. Smart Keystroke Processing: The Backspace, Delete, Left Arrow and Right Arrow symbols are now processed while displaying keystrokes. This allows you to get more accurate keystroke logging. Screen capture creation on each event: The feature allows creating screen captures each time the key is pressed or the mouse is clicked without using data sending time out. 10

11 System Requirements Desktop Surveillance claims different system requirements for each of its components. Make sure your hardware and software meet the following system requirements to avoid possible component malfunctions. Server requirements: 2 GHz or higher CPU 1024 MB or more RAM Enterprise-level Ethernet card Minimum 1 Gbit/s network adapter Windows Server 2008 and Both x86 and x64 platforms are supported..net Framework 4.5 NOTE: If the Server and the Management Tool are to be installed on the same computer, make sure you turn on the Internet Information Service before the installation of.net Framework 4.5. [When using MS SQL Database]: Full edition of MS SQL Server 2008 or higher. Standard license or higher is required. Only the English version is supported. Management Tool requirements: 2 GHz or higher CPU 1024 MB or more RAM 100 Mbit/s network adapter Microsoft Windows Vista, 7 (any edition except Home), 8, 8.1; Windows Server 2008 (starting from SP2 version) and Both x86 and x64 platforms are supported..net Framework 4.5 IIS 7.0 or higher with enabled ASP.NET support [For accessing the Management Tool locally or remotely] One of the following browsers: Google Chrome 37 or higher Mozilla Firefox 32 or higher Internet Explorer 10 or higher Safari S5 and S6 Opera 15 or higher NOTE: The Management Tool might be opened in other browsers, but its compatibility with other browsers is not guaranteed. Monitor requirements: 11

12 2 GHz or higher CPU 1024 MB or more RAM 100 Mbit/s network adapter Microsoft Windows Vista, 7, 8, 8.1; Windows Server 2008 and Both x86 and x64 platforms are supported. Client requirements: 1 GHz or higher CPU 512 MB or more RAM 100 Mbit/s network adapter Microsoft Windows XP SP2, Vista, 7, 8, 8.1; Windows Server 2003, 2008 and Both x86 and x64 platforms are supported It is recommended to have not less than 500Mb of free space on the disk where the Client is installed to save data during the offline session. NOTE: When the Client is installed to the terminal server, hardware requirements depend on the number of active user sessions and may increase drastically. For example, hardware requirements for the Client deployed on the terminal server hosting 10 active user sessions will be as follows: Intel Core i3 or similar AMD CPU 2048 MB RAM 12

13 Updating from Desktop Surveillance 2.6 to Desktop Surveillance 3.2 Update of the Desktop Surveillance from version 2.6 to version 3.2 might not be performed automatically. In this case we recommend you to follow the instructions below: 1. Uninstall all old Clients via the Administrative Panel. 2. Update the Server. 3. Install the Management Tool. 4. Install new Clients via the Management Tool. After the update all users, which had the role of Administrators in the previous version of the program, are added to the Administrators user group, and the users, which had the role of Supervisors in the previous version of the program, are added to the Supervisors user group. Pay attention that after the update you will have a new BUILTIN\Administrators user in the system. All users belonging to the Administrators group on the Server computer will be able to log in to the Management Tool and the Monitor. To log in as a local user from this Administrators group, use the following credentials: <server computer name>\<user login> and the local user password. 13

14 Program Structure Desktop Surveillance is an application specially designed to control user activity remotely. Desktop Surveillance includes the following components: Desktop Surveillance Server (further referred to as Server): It is the main part of Desktop Surveillance used for storing the screen captures and associated information received from the Clients. The work of the Server can be started or stopped via Server Tray. Desktop Surveillance Management Tool (further referred to as Management Tool): It is a central administrative unit that allows you to control and manage Clients, Users, Alerts, Server database and Serial Keys. Starting from the version 3.0, Management Tool (former Administrative Panel) has become a web tool, so all actions with it are performed via your browser. You can have access to the Management Tool from any computer in the network without having to install it on this computer. Desktop Surveillance Monitor (further referred to as Monitor): This part of Desktop Surveillance provides a usable interface for quick review and analysis of the screen captures received from the Clients. The alert monitoring function of the Monitor is accessible via Monitor Tray. Desktop Surveillance Clients (further referred to as Clients): Being hosted on the remote computers, Clients create screen captures of certain quality and defined frequency and send them to the Server. Managing the remote Clients configuration and settings is performed via the Management Tool. 14

15 Getting Started Deployment Process Desktop Surveillance installation consists of several steps: 1. Installing the Server: To deploy the system, first of all you need to install the Server. The Server is used to store and process all records sent by the Clients hosted on the remote computers. During the Server installation you can select the type of the database and define administrator credentials. 2. Completing Management Tool installation prerequisites: To install and run the Management Tool, you need to turn on the Internet Information Service on your computer, add the selfsigned or trusted certificate to the Trusted Root Certification Authorities and set HTTPS binding for a default web site (or any other IIS site). 3. Installing the Management Tool: The Management Tool is used to manage Users, Clients, Alerts and Databases. Connection with the Server is required for the Management Tool to operate. 4. Activating serial keys (adding activated serial keys): To be able to receive data from the Clients, you need to license the Clients by activating purchased serial keys. 5. Installing the Clients: The Clients are usually installed remotely via the Management Tool. A Client can be installed on any computer in the network. The Clients collect user activity data and send it to the Server. Please note that several conditions have to be met for successful remote Client installation. 6. Installing the Monitor: The Monitor is used to review user activity records stored on the Server. The Monitor can be installed on any computer in the network. Connection with the Server is required for the Monitor to operate. After installing all the system components, Desktop Surveillance is considered deployed and all its features become available. Working with Application The work with the application includes the following options: 1. Assigning licenses to the Clients: An available license is automatically assigned to the Client during its first connection to the Server. If the license hasn t been assigned to the Client, you need to assign it manually. 2. Adding Client Groups: Client Groups allow you to grant access to several Clients at the same time to your users without the necessity to grant them access to all the Clients. 3. Adding Users/User Groups and defining their permissions: To allow others to work with the Management Tool and Monitor, you can create new users and define their permissions in the Management Tool. 15

16 4. Defining Client configuration: The configuration allows you to manage the Client monitoring parameters, such as screen capture creation, keystroke logging, protected mode, application filtering, monitoring logs, forced user authentication, and additional message on user login. 5. Creating Alerts: Alerts are used to notify the investigators of a specific activity (potentially harmful/forbidden actions) on the target computers on which Clients are installed. 6. Viewing monitoring results in Monitor: The Monitor allows you to view the screen captures and the corresponding keystrokes received from the computers on which Clients are installed. 7. Receiving Alert notifications: The notifications on the alert events are received via the Monitor Tray, which is installed on the computer with the Monitor. The alerts are displayed in the pop-up notifications from the Windows tray area. 8. Generating reports: The user activity can be analyzed with the help of reports generated via the Management Tool. You can schedule the reports to be generated and sent via at the specified time or generate the reports manually via Report Generator. 9. Managing database: Not to run out of space on the Server computer, it s recommended to clean up the database periodically removing old unnecessary screenshots or enable the automatic clean-up. You can also remove unnecessary uninstalled Clients from the database. 16

17 Server and Database About The Server is the main component of the system, which provides interaction between other components. The Server stores all monitored data, user accounts, and system settings in the database. Database Types Comparison When installing the Server, you can choose between the two types of databases (MS SQL database and Firebird database). These databases have the following differences: Feature MS SQL Database Firebird Database Free No (has a limited free version) NOTE: Using MS SQL Express does not guarantee the stable work of the Server. Yes Processing speed High Low Remote access to database Yes No Requires additional software installation Yes No Security High Low 17

18 Installing/Uninstalling/Updating the Server Installing the Server To install the Server, do the following: 1. Run the DesktopSurveillance_Components.exe installation file. 2. Click Next on the Welcome page. 3. Carefully read the terms of the End-User License Agreement and click I Agree. 4. On the Choose Components page, do one of the following and click Next: In the drop-down list, select Desktop Surveillance Server. Select Desktop Surveillance Server in the box. 5. On the Choose Install Location page, enter the installation path or click Browse to navigate to the Server installation folder. Click Next. 6. On the Database Type page, select the type of the database you want to use for storing data. Click Next. For more information see the Database Types Comparison chapter. 7. If you have selected MS SQL Server, on the MS SQL Server Database Configuration page, define the connection parameters and then click Next. Define the MS SQL Server instance name, which is the instance name assigned to the TCP/IP port. Define the Database name for the database. Define the User name and Password of a user account via which the connection to the Server will be established. 8. If you have selected Firebird database, on the Database Location page, enter the database path or click Browse to navigate to the database installation folder. Click Next. 9. If you already have a database created during the usage of previous program versions, you will be offered to re-use it. If you want to use the existing database, click Yes. In other case, click No and the new database will be created. NOTE: If you click No, the existing database will be deleted. 10. On the Administrator password page, define the password for the administrator (the default user of Desktop Surveillance with login admin and full permissions). Click Next. 11. On the Client Uninstallation Key page, enter the key that will be used during the Client local uninstallation and click Next. By default, the Uninstallation key is allowed. You will be able to change this key via the Management Tool any time later. 12. On the Choose Start Menu Folder page, define the name of the folder in the Start menu to which the shortcuts will be placed. Click Install. 13. The installation process starts. Its progress is displayed on the Installing page. 14. After the end of the installation process, click Finish to exit the wizard. 18

19 15. In Windows Firewall, you must allow the Server executable to accept TCP connections via ports 3347 (for the connection between the Server and the Clients), 3349 (for the connection between the Server and the Monitor), (for the connection between the Server and the Management Tool). These rules will be added to Windows Firewall automatically if Windows Firewall is enabled during the Server installation. Adding Server Executable to Windows Firewall Please note that Windows Firewall will be adjusted automatically if it is enabled during the Server installation. If you use any other Firewall, it should be adjusted as well. To add the Server executable to the Windows Firewall, do the following: 1. In the Control Panel, select System and Security > Windows Firewall. 2. In the Windows Firewall window, click Advanced settings. 3. In the Windows Firewall with Advanced Security window, right-click Inbound Rules and select New rule. 19

20 4. The New Inbound Rule Wizard opens. 5. On the Rule Type page, select Program and click Next. 6. On the Program page, select This program path, then click Browse and navigate to the Server executable. The default path is "C:\Program Files\CensorNet\Desktop Surveillance\Server\Desktop SurveillanceServer.exe ". Click Next. 7. On the Action page, select Allow the connection and then click Next. 20

21 8. On the Profile page, select the profile of the network used for connecting remote computers and the Server. Click Next. 9. On the Name page, define the Name of the rule. Click Finish. 10. The rule is created for the Server application. By default, the rule allows any connections via all ports. 11. To define the protocol and ports, double-click the created rule. The Properties window opens. 12. In the Protocols and Ports tab, do the following: In the Protocol Type list, select TCP. In the Local port list, select Specific Ports. Type the following port numbers in the box below: o 3347 (for the connection between the Server and the Clients) o 3349 (for the connection between the Server and the Monitor) o (for the connection between the Server and the Management Tool) 13. Click Apply to save changes. Click OK. 14. Close the Windows Firewall window. 21

22 Using an External/Cloud-Based Server Computer If your Server is not in the same network as Clients or the Management Tool, do the following: 1. Make sure your Server has a unique external IP address. 2. Specify this address when installing the Management Tool and installing the Client. Updating the Server The updating of the Server is performed via the installation file of a newer version. During an update you may select to update the existing database to a newer version or simply reinstall it. To update the Server, do the following: 1. Run the DesktopSurveillance_Components.exe installation file. 2. On the Welcome page, click Next. 3. On the Already Installed page, select Update/Add/Remove components and click Next. 4. On the Choose Components page, select Desktop Surveillance Server and click Next. NOTE: If you have the Monitor installed on the same computer, you will need to select to update it as well, otherwise it will be removed. 5. On the Database Update page, if you want to keep the existing database, select Update database to a new version, otherwise select Reinstall the database. Click Next. NOTE: To change the type of the database, you need to reinstall the whole system. 6. The update process starts. 7. After the end of the update process, click Finish to exit the wizard. Uninstalling the Server NOTE: Before uninstalling the Server, make sure you have uninstalled all the Clients from the remote computers. If you don't uninstall the Clients, they will remain installed on the remote computers and collect the data locally. It will be impossible to remove them in a common way. To uninstall the Server from the local computer, do the following: 1. Run the DesktopSurveillance_Components.exe installation file or click Uninstall/Change on the Desktop Surveillance application in the Programs and Features window of the Windows Control Panel. 2. The setup wizard opens. 3. Click Next on the Welcome page. 22

23 4. On the Already Installed page, select Uninstall and click Next. 5. On the Uninstall Desktop Surveillance page, click Uninstall. 6. If you want to delete the database, click Yes in the confirmation message. In other case, click No and you will be able to use the saved database during the next installation of the program. 7. Wait for the uninstallation process to complete. Server Tray The Server Tray application informs you about the Server state. This application is installed on the computer where the Server is installed. It also automatically restarts the Server in case of its failure. The first three times the restart is performed automatically. The user is informed about the Server failure in the notification area. If the Server fails for the fourth time, it does not restart. You can start/stop the Server or hide the tray icon from the notification area. If you want to contact the Support, you need to collect the Server log (<Server installation folder>\serverservice.log) and attach it to the request. 23

24 Database Management About Database management is performed via the Management Tool by the user with the administrative Database management permission. During the database management process you can delete monitoring data collected by the Clients, delete offline or uninstalled Clients and shrink the database depending on its type. Database Cleanup There are two ways to perform the Server database cleanup: Manually: allows you to define the date interval for which the data is to be removed from the database. Automatically: allows you to define the period during which sessions will be stored in database and cleanup start time. The automatic database cleanup will be performed on a daily basis at a specified time and all old sessions of Clients will be deleted. To delete data from the Server manually, do the following: 1. Log in to the Management Tool as a user with the administrative Database management permission. 2. Click the Database Management navigation link on the left. 3. On the Database Management page, select the Database Cleanup tab. 4. On the Database Cleanup tab, enter the Start Date and End Date within which the monitoring data will be removed from the database. 24

25 NOTE: Only the whole sessions, i.e., the sessions whose start and end dates are within the defined period, will be removed. 5. Click Start Cleanup. To enable automatic database cleanup, do the following: 1. Log in to the Management Tool as a user with the administrative Database management permission. 2. Click the Database Management navigation link on the left. 3. On the Database Management page, select the Automatic Cleanup Settings tab. 4. On the Automatic Cleanup Settings tab, select the Enable automatic Server database cleanup check box. 5. Define the following options: Leave sessions in database (days): The number of days to store data before deleting. Start database cleanup at: The time to execute the clean-up operation. 6. To select the Clients whose monitoring data will not be deleted during automatic cleanup, click Add Exceptions. 7. On the Adding Exceptions page, check the necessary Clients and then click Add selected to add the Clients to the automatic cleanup list. Use filters to find a specific Client. 25

26 8. When all cleanup settings are defined, click Save. Shrinking MS SQL Database The database shrinking feature allows you to shrink the size of the MS SQL database to the actual amount of the data stored in it by cutting the space reserved by the database, but which is not used by it. NOTE: The database shrinking procedure may take some time (up to several hours) and cause performance slowdown. To shrink a database, do the following: 26

27 1. Log in to the Management Tool as a user with the administrative Database management permission. 2. Click the Database Management navigation link on the left. 3. On the Database Management page, select the Database Options tab. 4. On the Database Options tab, click Shrink database. NOTE: The progress of the database shrinking process is not displayed in the Management Tool and there is no indication of the process finishing. Firebird Database Optimization When using the Firebird database it is recommended to perform the Update statistics procedure at least every two months in order to optimize the database and increase the speed of reports generation. To perform the Update statistics procedure, do the following: 1. Log in to the Management Tool as a user with the administrative Database management permission. 2. Click the Database Management navigation link on the left. 3. On the Database Management page, select the Database Options tab. 4. On the Database Options tab, click Update statistics. Deleting the Client To delete the Client means to delete it completely from the database with cleaning up all its captured sessions. After this, the Client disappears from the Management Tool and its captured data is not displayed in the Monitor. It is possible to delete only offline or uninstalled (both after local or remote uninstallation) Clients. If after deletion the Client connects to the Server again, it will appear in the Management Tool but its deleted data will be unavailable. To delete one offline/uninstalled Client, do the following: 1. Log in to the Management Tool as a user with the administrative Database management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, select the needed offline or uninstalled Client from the list and click Edit Client. 27

28 4. On the Editing Client page, on the Properties tab, click Delete Client. 5. In the confirmation message, click Delete. 6. The Client is deleted. To delete several offline/uninstalled Clients, do the following: 1. Log in to the Management Tool as a user with the administrative Database management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, click Delete Clients. 4. On the Client Deletion page, click Add Clients to list. 5. The Client Deletion from Database page opens. It contains all Clients that can be deleted. NOTE: Only offline and uninstalled Clients are displayed in the list. 6. Select the needed Clients from the list and then click Next. To find a specific Client, enter its name in the Contains box and click Apply Filters. 28

29 7. When all Clients are selected, click Delete on the Client Deletion from Database page. 8. The Clients are deleted from the Server (with all captured sessions) and disappear from the Management Tool. Moving the Server Database If you are using an MS SQL database, you can move it to another location on the same computer using SQL Management Studio. If you are using the Firebird database, you can change its location to another disk/directory or rename it. To change the location for the Server Firebird database, do the following: 1. Stop the Server by clicking Stop in the right-click menu of the Server tray icon or find the Server application in the Task Manager and click End task. 2. Open the Windows Registry Editor. 3. In the Registry Editor window, select the HKEY_LOCAL_MACHINE\SOFTWARE\CensorNet\Desktop Surveillance key. 4. Find the Database values (Database and ManagedDatabase) and see where the Database files are located on your computer. 5. Move the folder with database files to a new location. NOTE: The folder contains the DESKTOPSURVEILLANCEACTIVITYDB.FDB and MANAGEMENTDATABASE.FDB files and the Cache sub-folder. 6. In the Registry Editor window, modify the following values: Database: Enter the full path to the DesktopSurveillanceActivityDB.fdb file (including the file name) in its new location and then click OK. 29

30 Managed Database: Enter the path to the folder with Desktop Surveillance database in its new location and then click OK. 7. The Database location is changed. Start the Server to continue working with the program. 30

31 Management Tool About The Management Tool is the component for managing the whole system. It can be installed on any computer, but a network connection to the Server is required for the Management Tool to operate. There can be several computers with the installed Management Tool in the system. The work with the Management Tool is performed via your browser. Management Tool Installation Prerequisites Prerequisites Overview The following prerequisites are necessary for successful installation of the Management Tool. For Windows 7, it is important that you follow these steps in the correct order. To be able to install the Management Tool, you need to: 1. Turn on the Internet Information Service. 2. Install.NET Framework Configure the Internet Information Service. 4. Generate a self-signed certificate or import a purchased SSL certificate issued for the computer on which the Management Tool will be installed. 5. Add the certificate to the Trusted Root Certification Authorities on the computer on which the Management Tool will be installed. Otherwise a certificate error will be displayed in your browser when opening the Management Tool. 6. Set HTTPS binding for a default web site (or any other IIS site). NOTE: If you already have a certificate generated for the computer on which the Management Tool will be installed, you can skip certificate generation step and use an existing certificate. Turning on Internet Information Service (IIS) Turning on IIS for Windows Vista, Windows 7 and Windows 8 To turn on the Internet Information Service for Windows Vista, Windows 7 and Windows 8, do the following: 1. Select Control Panel > Programs and Features (Program uninstallation). 31

32 2. Click the Turn Windows features on or off navigation link. 3. The Windows Features window opens. 4. In the features tree-view, select the Internet Information Services check box. 5. Click OK. Turning on IIS for Windows Server 2008 and Windows Server 2008 R2 To turn on the Internet Information Service for Windows Server 2008 and Windows Server 2008 R2, do the following: 1. In the Start menu, select All Programs > Administrative Tools > Server Manager. 2. In the navigation pane, select Roles, and then click Add Roles. 32

33 3. The Add Roles Wizard opens. 4. On the Before You Begin page, click Next. 5. On the Server Roles page, select Web Server (IIS), click Next, and then go to the Role Services page to start configuring Web Server (IIS). Turning on IIS for Windows Server 2012 To turn on the Internet Information Service for Windows Server 2012, do the following: 1. In the Start menu, select Server Manager. 2. In the navigation pane, select Dashboard, then click Manage > Add roles and features. 33

34 3. The Add Roles and Features Wizard opens. 4. On the Before You Begin page, click Next. 5. On the Installation type page, select Role-based or feature-based installation, and then click Next. 6. On the Server Selection page, select Select a server from the server pool, select your server from Server Pool list, and then click Next. 34

35 7. On the Server Roles page, select Web Server (IIS), click Next and then click Add Features to start configuring Web Server (IIS). 35

36 Installing.NET Framework 4.5 NET Framework 4.5 is usually installed on Windows 8, Windows 8.1, and Windows Server 2012 by default. If you are using Windows Vista, 7, Windows Server 2008, or if there is no.net Framework 4.5 on other Windows versions, you can download it from the Microsoft official website and run the installation file on your computer. Configuring Internet Information Service (IIS) Windows 8 Make sure that all the following check boxes are selected in the Windows Features window and then click OK:.NET Framework 3.5 and.net Framework 4.5 Advanced Services; Internet Information Services > Web Management Tools > IIS Management Console; Internet Information Services > World Wide Web Services > Application Development Features > ASP.NET 3.5 and ASP.NET 4.5; Internet Information Services > World Wide Web Services > Common HTTP Features > Static Content. 36

37 Windows Vista/Windows 7 Make sure that all the following check boxes are selected in the Windows Features window and then click OK: Internet Information Services > Web Management Tools > IIS Management Console; Internet Information Services > World Wide Web Services > Application Development Features > ASP.NET; Internet Information Services > World Wide Web Services > Common HTTP Features > Static Content. Windows Server In the Add Roles Wizard window, on the Role Services page, make sure that the following check boxes are selected: Common HTTP Features > Static Content; Application Development > ASP.NET. 2. Click Next and then click Add Required Role Services. 3. On the Role Services page, make sure that the following check boxes are selected: Management Tools > IIS Management Console. 4. Click Next and then click Install. 5. After the end of installation, click Close. 37

38 Windows Server In the Add Roles and Features Wizard window, on the Server Roles page, make sure that the Web Server (IIS) check box is selected and then click Next. 2. On the Features page, make sure that the following check boxes are selected:.net Framework 3.5 Features (Installed) >.NET Framework 3.5;.NET Framework 4.5 (Installed) > ASP.NET Click Next. 3. On the Web Server Role IIS page, click Next. 4. On the Role Services page, select the ASP.NET 4.5 check box (under Application Development). 5. Click Next and then click Add Features. 6. On the Role Services page, make sure that the following check boxes are selected: Application Development >.NET Extensibility 4.5 > ASP > NET 4.5 > ISAPI Extensions > ISAPI Filters. 7. Click Next and then click Install. 8. After the end of installation, click Close. 38

39 Using Certificates Generating Self-Signed Certificate To generate a self-signed certificate on the machine on which you will install the Management Tool, do the following: 1. Open the Internet Information Service Manager: For Windows 7 or Windows 8: Open Computer > Manage > Services and Applications > Internet Information Services (IIS) Manager. For Windows Server 2008 or 2012: Press Windows+R, enter inetmgr in the Run window and then press Enter. NOTE: Using the inetmgr command is a common way of opening the Internet Information Service Manager for any version of the Windows operating system. 2. Click the main node in the Connections tree-view and then double-click the Server Certificates item under the IIS category. 3. The Server Certificates pane opens. 4. On the Actions pane (to the right), click Create Self-Signed Certificate. 39

40 5. The Create Self-Signed Certificate window opens. 6. Enter the name for a certificate in the Specify a friendly name for the certificate box and select Personal in the Select a certificate store for the new certificate drop-down list. Click OK. 7. The certificate is created. Exporting Self-Signed Certificate To export self-signed certificate, do the following: 40

41 1. In the Internet Information Service Manager, on the Server Certificates pane, select the generated certificate and click Export on the Actions pane or in the certificate right-click menu. 2. In the Export Certificate window, define the location and password for the certificate. Click OK. 3. The certificate is exported and can be added to the Trusted Root Certification Authorities. Importing Trusted Certificate To import a purchased certificate issued for the computer, do the following: 1. Open the Internet Information Service Manager: For Windows 7 or Windows 8: Open Computer > Manage > Services and Applications > Internet Information Services (IIS) Manager. For Windows Server 2008 or 2012: Press Windows+R, enter inetmgr in the Run window and then press Enter. NOTE: Using the inetmgr command is a common way of opening the Internet Information Service Manager for any version of the Windows operating system. 2. Click the main node in the Connections tree-view and then double-click the Server Certificates item under the IIS category. 3. The Server Certificates pane opens. 4. On the Actions pane (to the right), click Import. 5. In the Import Certificate window, click the dots ( ) to browse for the file of the purchased certificate and enter its password in the Password field. 6. Click OK. 7. The certificate is imported and displayed on the Server Certificates pane of the Internet Information Services (IIS) Manager. 41

42 Adding Certificate to Trusted Root Certification Authorities Before adding the self-signed certificate to the Trusted Root Certification Authorities, it should be exported. For purchased certificates that were issued for your computer this procedure is not needed. To add the certificate to the Trusted Root Certification Authorities, do the following: 1. Press Windows+R, type mmc in the Run text box and press Enter. 2. In the opened User Account Control window, click Yes. 3. In the Console window, select File > Add/Remove Snap-in. 4. In the opened Add or Remove Snap-ins window, select Certificates > Add. 5. In the opened Certificates snap-in window, select Computer account and click Next. 42

43 6. In the opened Select Computer window, select Local computer: (the computer this console is running on) and click Finish. 7. In the Add or Remove Snap-ins window, click OK. 8. In the Console window, expand the Certificates (Local computer) node. 9. In the Certificates (Local computer) tree-view, find the Trusted Root Certification Authorities node. 10. In the right-click menu of the Trusted Root Certification Authorities node, select All Tasks > Import. 43

44 11. The Certificate Import Wizard opens. 12. On the Certificate Import Wizard Welcome page, click Next. 13. On the File to Import page, click Browse to find the certificate to be imported and then click Next. 14. On the Private key protection page, enter the certificate password and then click Next. 44

45 15. On the Certificate Store page, click Next. 16. On the last page of the Certificate Import Wizard, click Finish. 45

46 17. In the confirmation message, click OK. 18. The certificate is imported and is displayed in the Console window in the Certificates node. Please note that the Issued To field contains the name of the computer on which the Management Tool will be installed in the format that will be used when opening the Management Tool. 46

47 19. Close the Console window. Setting HTTPS Binding for a Default Web-Site To set HTTPS binding for a default web-site, do the following: 1. Open the Internet Information Service Manager: For Windows 7 or Windows 8: Open Computer > Manage > Services and Applications > Internet Information Services (IIS) Manager. For Windows Server 2008 or 2012: Press Windows+R, enter inetmgr in the Run window and then press Enter. NOTE: Using the inetmgr command is a common way of opening the Internet Information Service Manager for any version of the Windows operating system. 2. Expand the node with the name of the target computer in the central pane. 3. Expand the Sites node. 4. Select the Default Web Site. NOTE: If there is no such site in the Internet Information Services (IIS) Manager of your computer, you can select any other site (the name of the site does not matter). 47

48 5. Click the Bindings navigation link on the right. 6. The Site Bindings window opens. 7. If there is no binding of HTTPS type in the Site Bindings window, click Add. 8. The Edit Site Binding window opens. 9. In the Type box, select https. 48

49 10. Next to the SSL certificate drop-down list, click Select. 11. The Select Certificate window opens, where the list of existing certificates is displayed. 12. In the Select Certificate window, select the certificate generated for the Management Tool and then click OK. 13. In the Add Site Binding window, click OK. 14. In the Site Bindings window, click Close. 15. Now the Internet Information Service is fully adjusted and you can start installing the Management Tool. Installing/Uninstalling/Updating the Management Tool Installing the Management Tool To install the Management Tool, do the following: 1. Run the DesktopSurveillance_ManagementTool.exe installation file. 2. On the Welcome page, click Next. 3. Carefully read the terms of the End-User License Agreement and click I Agree. 4. On the Connection Settings page, do the following and then click Next: In the Server address box, enter the name or IP address of the computer on which the Server is installed. In the URL address field enter the folder where the Management Tool will be located within IIS. This URL will be used when opening the Management Tool. 5. On the Choose Install Location page, enter the destination folder in the corresponding field or click Browse and in the Browse For Folder window, define the destination folder. Click Install. 6. The installation process starts. Its progress is displayed on the Installing page. 7. After the end of the installation process, click Close to exit the wizard. 8. The Management Tool is displayed as an application of a default web site or any other site with https connection in the Internet Information Services (IIS) Manager. 9. Now you can open the Management Tool via your browser from the same computer or a remote one. 49

50 Adjusting Computer for Remote Access If you want to open the Management Tool from the computer different from the one where the Management Tool is installed, you need to adjust Firewall settings to be able to access this computer. If the users access Management Tool only from computers where it is installed, there is no need to configure Firewall. To adjust Firewall on the computer where the Management Tool is installed, do the following: 1. In the Control Panel, select System and Security > Windows Firewall. 2. In the Windows Firewall window, click Advanced settings. 3. In the Windows Firewall with Advanced Security window, right-click Inbound Rules and select New rule. 4. The New Inbound Rule Wizard opens. 5. On the Rule Type page, select Predefined and then select Secure World Wide Web Services (HTTPS) in the list. Click Next. 6. On the Predefined Rules page, select the World Wide Web Services (HTTPS Traffic-In) check box. Click Next. 50

51 7. On the Action page, select Allow the connection. Click Finish. 8. The new inbound rule for Firewall is created. Updating Management Tool To update the Management Tool, do the following: 1. Run the Management Tool installation file (DesktopSurveillance_ManagementTool.exe) of a newer version. 2. On the The program is already installed page, select Update and then click Next. 3. Follow the installation instructions. 4. The Management Tool will be updated to the new version. 51

52 Uninstalling Management Tool To uninstall the Management Tool, do the following: 1. Open the Programs and Features window of the Windows Control Panel. 2. In the Programs and Features window, find the Desktop Surveillance Management Tool application. 3. In the right-click menu of the application, select Uninstall. 4. The setup wizard opens and starts the uninstallation process. 5. When the process is completed, click Close, to exit the setup wizard. 6. The Management Tool is uninstalled and removed from the Internet Information Service (IIS). Opening Management Tool To open the Management Tool, do the following: 1. Open the browser and enter of the computer or IP on which the Management Tool is installed>/<url address that has been specified during the Management Tool installation> in the address line. For example, NOTE: If the certificate is not added to the Trusted Root Certification Authorities or the name of the computer entered in the browser address doesn t match the subject (Issued To field) of the certificate, your browser will display a certificate error when opening the Management Tool. 2. The Management Tool opens. 3. Enter the credentials of the existing user, added to the system: For an internal user, enter the login and password defined during user creation. For a Windows user, enter the login in the form <domain name>\<user name> and Windows authentication password. Please note, if the Active Directory user group has been added to the system, the users belonging to it can login using their Windows credentials. 4. The Management Tool Home page opens. If you encounter any problems when opening the Management Tool, see the Troubleshooting chapter. 52

53 Management Tool Interface The Management Tool interface is divided into the following areas: Navigation pane Data View pane Filtering pane Toolbar Panes The Navigation pane The Navigation pane allows you to navigate between different sections of the Management Tool and consists of the following navigation links: Home page: Opens the page on which the information about the number of used Licenses and installed Clients is displayed. Client Management: Displays the information about all Clients in the system. The number of Clients displayed on the page depends upon permissions given to users that log in to the Management Tool. User Management: Displays the information about all Users in the system and is available for users that have the User management permission. Alert Management: Displays the information about alerts assigned to your Clients. Scheduled Reports: Opens the Scheduled Reports page on which the user can view and manage report generation rules, and view rule logs. Report Generator: Opens the Report Generator page on which the user can generate the report of the required type by defined parameters and then save it or print it. Database Management: Opens the page with Manual Cleanup and Auto Cleanup options used for deleting the data from your Database by users that have the Database management permission. Serial Key Management: Displays the information about your Serial key and contains keys activating/deactivating options and is available for users that have the Serial keys management permission. The Data View pane The Data View pane contains a grid with the information about your Clients, Users, Alerts, database, and Serial keys. 53

54 The Filtering pane The Filtering pane allows you to filter the Clients, Users, and Alerts by keywords of their names and hide offline/online/uninstalled/licensed Clients. Toolbar The Toolbar of the Management Tool allows you to perform basic actions with Clients, Users, and Alerts. The options of the Toolbar are the following: For Client Management: Add Client Group, Install Clients, Manage Licenses, Edit Uninstallation Key, Uninstall Clients, and Delete Clients. For User Management: Add User and Add User Group. For Alert Management: Add Alert and Global Alert Settings. Changing Password for Logged in User Internal users, including the Built-in administrator, can change their password after logging in to the Management Tool. This action is not available for Active Directory users. To change your password, do the following: 1. Click the button with your user name in the upper right corner of any Management Tool page. 2. The Manage account page opens. 3. In the Current password box, type your current password. 4. In the New password box, type the new password. 5. Re-enter the password in the Confirm password box. 6. Click Change password. 54

55 7. Your password is changed. You ll need to use it on the next log in. 55

56 Licensing General Licensing Information To start receiving information from the Clients, you have to assign licenses to them. Two types of licenses are available: Workstation license: Clients with this license monitor only one session, either remote or local, on the investigated computer. NOTE: Licenses of the workstation type cannot be assigned to a computer with Server OS. Server license: Clients with this license monitor unlimited number of remote sessions and any local sessions on the investigated computer. Remote sessions include Remote Desktop sessions, terminal sessions, etc. Each Client can have only one license assigned, either workstation or server. During the first connection to the Server, the license corresponding to the Client OS is automatically assigned to a Client. If the license has not been automatically assigned, then you will have to assign the license to the Client manually. Initially, when you start the Server for the first time on a computer, you have an embedded trial serial key which allows you to use 5 workstation licenses and 1 server license for 30 days. To use the system permanently and with greater number of licenses, you have to license it with purchased serial keys on a computer with the installed Server. NOTE: After activation of any serial key, the embedded trial key expires. Two types of serial keys are available: Standard serial keys: These keys allow you to use licenses they contain during the unlimited period of time and allow you to update the product during 12 months from activation. Trial serial keys: These keys allow you to use the licenses they contain during 30 days from activation and update the product during this period. Each serial key includes the following parameters: Subscription period Server licenses for the Clients Workstation licenses for the Clients Once you have purchased serial keys, you can either activate serial keys online or add activated serial keys if you have no Internet connection on a computer with the installed Server. Contact your vendor for information on purchasing serial keys. You need the administrative Serial keys management permission to activate serial keys. 56

57 Please note, after the activation, serial keys are bound to a specific computer and cannot be used on another computer. About Subscription A subscription is a period that defines what updates can be applied to your copy of the product. Updates are defined by their release date. After the subscription expires, you can still assign licenses to Clients, but you won t be able to update the System to versions released after the subscription expiration date. The subscription end date is defined during the serial key activation (either via the Management Tool or on the vendor s site). It is calculated using a serial key with the longest subscription period. Example: If you activate two keys, one with a 30 days subscription period and one with a 12 months subscription period, simultaneously, the subscription end date will be set to 12 months from the activation date. When a new serial key is being activated, the subscription period is prolonged accordingly. Please note, if the current subscription period is longer than the one of a key being activated, current subscription period doesn t change. For example, if you activate a key with 12 months subscription period after a key with 30 days subscription period, the subscription end date will be set to 12 months since the activation date. But if you activate a key with 30 days subscription period after a key with 12 months subscription period, the subscription end date will not change. If your subscription expires, you can purchase a special subscription extension serial key, which does not contain any keys, but extends your subscription period, or you can activate any other serial key. Viewing License State You can view the information on serial keys you have activated or added and license details on the Serial Key Management page in the Management Tool. To view the license state, open the Management Tool and click Serial Key Management navigation link on the left. The following information is displayed on the Serial Key Management page: Subscription end date: The subscription end date is calculated basing on dates of serial keys activation and their subscription periods. 57

58 Workstation licenses used: The number of workstation licenses used out of total number, which is summed up from all activated serial keys. Server licenses used: The number of server licenses used out of total number, which is summed up from all activated serial keys. Not licensed Clients: Displays the number of installed Clients with no licenses assigned. The following information is displayed in the Serial Keys Management table: o Serial key o Activation date o Deactivation date (for deactivated keys only) o Number of server licenses o Number of workstation licenses o Key state: activated/deactivated/expired. For a trial serial key, an expiration date is displayed near the key state. Activating Serial Keys Online To activate purchased serial keys online, do the following: 1. Make sure you have an active Internet connection on the computer with the installed Server. 2. Log in to the Management Tool as a user with the administrative Serial keys management permission. 3. Click the Serial Key Management navigation link on the left. 4. On the Serial Key Management page, click Activate keys online. 5. In the Serial Key Activation window, enter serial keys to be activated separating them with semicolons or paragraphs and click Activate. 58

59 6. The activated keys will appear on the Serial Key Management page. 7. The number of available server and workstation licenses and the subscription end date change. Adding Activated Serial Keys Offline If you have no Internet connection on a computer on which the serial keys are to be activated, you can activate them on the license site and then add the activated serial keys offline. For more information, send an to info@censornet.com To activate serial keys offline on the license site, do the following: 1. On the computer with the installed Server, start the UniqueIdentifierGenerator.exe file, which you can find near the Server installation file. 2. The Unique Identifier Generator window opens. 3. Click Generate to generate a unique identifier for your computer. 4. When a unique identifier for your computer is generated, it will appear in a text box under the Unique Identifier group of options. 5. Copy the unique identifier from the text box to a text file on a removable drive. 6. Go to the license site. 7. Enter the generated unique identifier in the Unique Identifier box. 8. Copy and paste the purchased serial keys to the Serial Keys box separating them with paragraphs or spaces. 9. Enter the CAPTCHA text in a text box near the CAPTCHA image. 10. Click Activate. 11. The activatedkeys.txt file will be generated. Save the file on a removable drive. 12. Copy the file to the computer on which you will open the Management Tool. NOTE: Please do not edit the generated file activatedkeys.txt. To add activated serial keys in offline mode, do the following: 1. Log in to the Management Tool as a user with the administrative Serial keys management permission. 2. Click the Serial Key Management navigation link on the left. 3. On the Serial Key Management page, click Add activated keys. 4. On the Activated Serial Key Adding page, click Choose File and navigate to the activatedkeys.txt file with activated serial keys. 5. Click Add. 6. The newly added serial keys appear on the Serial Key Management page. 59

60 7. The number of available server and workstation licenses and the subscription end date change. 8. If there are both licensed and unlicensed Clients in your network and you want to license the rest of Clients with a purchased key, you will have to assign the license to the remaining unlicensed Clients manually. Deactivating Serial Keys If for some reason you ve decided to discontinue using Desktop Surveillance, you can deactivate serial keys. To deactivate a serial key, do the following: 1. Make sure you have an active Internet connection on the computer with the installed Server. 2. Log in to the Management Tool as a user with the administrative Serial keys management permission. 3. Click the Serial Key Management navigation link on the left. 4. On the Serial Key Management page, select a serial key to be deactivated and click Deactivate selected. NOTE: Expired serial keys can t be deactivated. 5. In the confirmation message, click Deactivate. 6. The deactivated serial key is marked as Deactivated in the State column of the Serial Key Management page. 7. The number of available server and workstation licenses and the subscription end date change. Client License Management The Client license management is performed in the Management Tool by the user with the administrative Client installation and management permission. You can assign a license to a Client or unassign it manually any time. The license can be assigned to an offline Client, and it will be applied after the Client is online. If the Client is uninstalled, its license becomes free and can be assigned to another Client. NOTE: When a trial serial key expires, the corresponding number of licenses is automatically unassigned from Clients. Information about the number of used and free licenses of each type is displayed on the Serial Key Management page in the Management Tool. To assign the license to one Client, do the following: 60

61 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, select the needed Client from the list and then click Edit Client. 4. On the Editing Client page, on the Properties tab, in the License box, select the type of license you want to assign to the Client. 5. Click Finish. 6. The license is assigned to the Client. To manage the licenses for several Clients, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Сlick the Client Management navigation link on the left. 3. On the Clients page, click Manage Licenses. 4. On the License Management page, select the Clients to which the licenses should be assigned. To find a specific Client, enter its name in the Contains box and click Apply Filters. 5. When the Clients are selected, click one of the following: Assign workstation license: Assigns licenses to the selected Clients installed on the computers with not Server OS. Assign server license: Assigns licenses to the selected Clients installed on the computers with Server OS. Assign recommended license: Automatically defines the type of the licenses to be assigned basing on the OS of the computers on which the Clients are installed. Unassign license: Removes licenses from the selected Clients. 61

62 NOTE: To change the Client license type, you don't need to unassign the current license. This will be done automatically. 62

63 User and User Group Management About By default, there is one administrator in the system, whose login is admin and whose password is defined during the Server installation. The administrator has all the rights for work in the system. In order to grant others access to the system, you can add users and define their permissions. There are two types of users: Internal users Active Directory Users (Windows domain users) To define permissions for users, you can create user groups. One user can belong to several user groups. When the user is added to a group, he/she inherits all permissions from a group. If the user inherited some permissions from a group, these permissions can be removed only by removing the user from this group. Apart from permissions received from the group, you can assign other permissions to a specific user. By default, there are three user groups in the system: All Users: A group that contains all created users. Administrators: A group of users that can perform administrative functions within the system. If a user is added to this group, he/she receives all administrative and Client permissions within the system. This user group corresponds to the Administrator role in the earlier versions of the application. Supervisors: A group of users that perform major investigative work with the Clients. If a user is added to this group, he/she receives the Viewing monitoring results permission for All Clients. This user group corresponds to the Supervisor role in the earlier versions of the application. You can also add other custom user groups and manage them yourself. Please note, user and user group management is allowed only to the users with the administrative User management permission. Viewing Users and User Groups The Users and User Groups are displayed on the User Management page in the Management Tool. Users are grouped by the User Groups which they belong to. The lists of Users contain the following information: User Name First Name Last Name 63

64 Description NOTE: For Active Directory users, their first name and last name will be filled automatically after the first log in to the system. To find a required User, enter a part of his/her user name, first name, last name or description in the Contains box and click Apply Filters. On the User Management page, you can add new Users/User Groups and edit existing Users/User Groups (including deleting). User Management Adding Users To add a new user, do the following: 1. Log in to the Management Tool as a user with the administrative User management permission. 2. Click the User Management navigation link on the left. 3. On the Users page, click Add User. 4. On the User Type tab, select the type of the user you want to add: Click Add an Internal user to create an internal application user. Click Add an Active Directory user/user group to add an existing Windows user/user group. 64

65 5. On the User Details tab, do one of the following and click Next: For an internal user, define user credentials and additional information about the user. NOTE: Login and password are required. The password must be at least 6 characters long. The maximum length of the first name, last name, and description is 200 characters. For an Active Directory user, enter User login and Domain. 65

66 6. On the User Groups tab, select the user groups to which the user will belong. To find a specific group, enter its name in the Contains box and click Apply Filters. Click Next. NOTE: The user is automatically added to the default All Users group and can t be removed from it. 7. On the Administrative Permissions tab, select administrative permissions that will be given to the user. Click Next. NOTE: If the user has inherited some permissions from user groups, you can only add new permissions. To remove permissions inherited from user groups, you need to remove the user from these groups. 66

67 8. On the Client Permissions tab, do the following: Select the necessary Client/Client Group. To find a specific Client/Client Group, enter its name in the Contains box and click Apply Filters. Click Edit Permissions and then, in the Client Permissions/Client Group Permissions window, define the Client permissions which will be given to a user for the corresponding Client/Client Group. When the permissions are defined, click Save to close the Client Permissions/Client Group Permissions window. 9. Click Finish. 10. The user is added and displayed on the Users page. NOTE: For an AD user, the first name and last name properties will be automatically filled after the user s first login to the system. Editing Users To edit an existing user, do the following: 1. Log in to the Management Tool as a user with the administrative User management permission. 67

68 2. Click the User Management navigation link on the left. 3. On the Users page, click Edit User for the required user. 4. Edit user properties and permissions on the corresponding tabs in the same way as when adding a new user. NOTE: Click Next or Finish to save the changes on each tab. 5. The user is edited. Deleting Users Deleting a user means that a user will not be able to use the system. If you delete the user who is logged in the Management Tool, the Management Tool will become unavailable for the user at once and none of its pages will be displayed. If the user is deleted while working with the Monitor, the application will continue working till the end of session, after which it will be impossible for the user to log in and run the Monitor again. To delete a user, do the following: 1. Log in to the Management Tool as a user with the administrative User management permission. 2. Click the User Management navigation link on the left. 3. On the Users page, click Edit User for the required user. 4. On the User Details tab, click Delete User. 5. In the confirmation message, click Delete. 6. The user is deleted. User Group Management Adding User Groups To add a new user group, do the following: 1. Log in to the Management Tool as a user with the administrative User management permission. 2. Click the User Management navigation link on the left. 3. On the Users page, click Add User Group. 4. On the Group Properties tab, define the name for the user group and optionally define its description. Click Next. NOTE: The maximum length of the group name and description is 200 characters. 5. On the User Management tab, select users that will belong to the user group. To find a specific user, enter its name in the Contains box and click Apply Filters. Click Next. 68

69 6. On the Administrative Permissions tab, select administrative permissions that will be given to all users belonging to this user group. Click Next. 7. On the Client Permissions tab, find the Client/Client Group for which permissions are to be defined. To find a specific Client/ Client Group, enter its name in the Contains box and click Apply Filters. Click Edit Permissions and then, in the Client Permissions/ Client Group Permissions window, define the Client permissions which will be given to a user for the corresponding Client/Client Group. After you have defined all Client permissions, click Save to close the Client Permissions/ Client Group Permissions window. 8. On the Client Permissions tab, click Finish. 9. The user group is added. Editing User Groups To edit an existing user group, do the following: 1. Log in to the Management Tool as a user with the administrative User management permission. 2. Click the User Management navigation link on the left. 3. On the Users page, click Edit User Group for the required user group. 4. Edit user group properties and permissions on the corresponding tabs in the same way as when adding a new user group. NOTE: Click Next or Finish to save the changes on each tab. 5. The user group is edited. Deleting User Groups Deleting a user group does not delete users belonging to it. If the group is deleted, its users no longer have permissions given by this user group unless these permissions are inherited from another user group. NOTE: The user group All Users cannot be deleted. To delete a user group, do the following: 1. Log in to the Management Tool as a user with the administrative User management permission. 2. Click the User Management navigation link on the left. 3. On the Users page, click Edit User Group for the required user group. 4. On the Group Properties tab, click Delete Group. 69

70 5. In the confirmation message, click Delete. 6. The user group is deleted. Permissions About Permissions The permissions allow you to define which functions a user will be able to perform with the system and Clients. There are two types of permissions: administrative permissions and Client permissions. Administrative permissions define actions that a user can perform with the whole system. Client permissions define actions that a user can perform with selected Clients. The permissions can be defined during user and user group adding/editing. If you define permissions for the group, any user belonging to this group inherits these permissions. To remove permissions inherited by the user from a group, you need to remove the user from a group. Apart from permissions inherited from the group, you can assign a user his/her own permissions. Administrative Permissions The following administrative permissions are available: Serial keys management: Allows a user to activate and deactivate serial keys. User management: Allows a user to add, edit, delete Users/User groups and define permissions for them. Client installation and management: Allows a user to install Clients, assign licenses to Clients, add, edit, and delete Client groups, manage alerts, define alert settings, create and manage scheduled report rules, view report logs, and define sending settings. Database management: Allows a user to get information on the database, perform database cleanup, and delete Clients from the database. Client Permissions Client permissions define which actions a user will be able to perform with the Clients. If a user does not have the administrative Client installation and management permission, in the Management Tool he/she will see only those Clients for which he/she has at least one Client permission. NOTE: Client permissions are defined for each Client or Client Group individually. 70

71 The following Client permissions are available: Client uninstallation: Allows a user to uninstall a Client. Client configuration management: Allows a user to define Client configuration. Viewing monitoring results: Allows a user to view the results of Client monitoring in the Monitor, view Client configuration, generate reports in the Management Tool, and enable the additional notification message to a user. Login to Client computer: Allows a user to log in to the Client computer with enabled forced user authentication and is available only for the Client with server OS. Permission Example You can define the permission for a user, by selecting the Edit User option and selecting the check box next to the required permission on the Administrative Permissions tab. If the user belongs to several Groups, he/she will inherit all the permissions defined for them. For example: There is a user Joe who belongs to Group 1 and Group 2 user groups. Besides, there are Client 1 and Client 2 that belong to All Clients group. The following permissions are given to the user Joe, Group 1, and Group 2 by the administrator: User/User Group Administrative permissions Permission Client permissions For Group 1 User management Client uninstallation Client 1 Group 2 Serial keys management Viewing monitoring results Client 2 User Joe Client installation and management Viewing monitoring results Client 1 Serial keys management Client configuration management All Clients As a result, the user Joe will have the following permissions: Administrative o User management permission (Because he belongs to Group 1). o Serial keys management permission (Because he belongs to Group 2. But he also has his own Serial keys management permission, and thus will have it even if Group 2 is deleted or its permissions are edited). o Client installation and management permission (He will have this permission irrespective to user groups which he will be added to). 71

72 Client permissions for Client 1 o Client uninstallation permission (Because he belongs to Group 1). o Viewing monitoring results permission (Because it is his own permission and he will have it irrespective to user groups which he will be added to). o Client configuration management permission (Because the Client belongs to All Clients group). Client permissions for Client 2 o Viewing monitoring results permission (Because he belongs to Group 2). o Client configuration management permission (Because the Client belongs to All Clients group). 72

73 73

74 Clients About The Client is a program that can be installed on the target computers to monitor the activity of their users. The monitored data is sent by the Client to the Server and can be viewed via the Monitor application. Depending upon his/her permissions, a user can install/uninstall Clients remotely, manage their configuration, and manage Client groups. Monitoring via Clients The Clients work as follows: Each Client starts automatically on computer start. A licensed Client performs the monitoring of both remote and local sessions. Clients with a server license can monitor many sessions simultaneously. Clients with a workstation license monitor only one session (local or remote). Every time the computer is restarted, the Client starts recording screen captures in a new session. The maximum duration of one session can be 24 hours. At 00:00 all live sessions are terminated. After their termination (their status changes from live to finished), new live sessions automatically start. If a user works with several monitors, the Clients creates screen captures from all of them. The Client sends its monitoring results to the Server. If there is no connection with the Server, the Client stores the monitored data and automatically sends it to the Server when the connection is renewed. The data is stored in the in TempWrite.dat file in the Client folder, which is located here: C:\Program Files\CensorNet\Desktop Surveillance\Client. The screen capture creation frequency of the Client is the following: o If the user is typing the text, the screen capture is created once in 10 seconds. o If the user clicks a mouse, the screen capture is created once in 3 seconds. o If the user changes an active window, the screen capture is created once in 3 seconds. Screen capture creation triggers usually influence each other. Though the average screen capture creation frequency is higher. If the Capture screen on each event without timeout parameter is selected for the Client, screen captures are created on each mouse click or keyboard key pressing without using data sending time out. WARNING! The Capture screen on each event without timeout option affects CPU usage on the Client computer and database size. It is not recommended to use this option for a great number of Clients and for a long period of time. 74

75 Installing the Clients About Client Installation During the system deployment, remote installation of the Clients is used. Remote installation of the Clients is performed via the Management Tool. To ensure successful remote installation of the Clients, you have to set up the network environment beforehand. If your computers belong to a workgroup but not a domain, you need to know the administrator account credentials for each remote computer. Otherwise, knowing the domain administrator credentials is enough. The Clients can also be installed locally via the installation package generated in the Management Tool. Thus you can distribute the installation package of the Client with predefined settings among the network computers and install it. This kind of installation is useful when you experience difficulties with installing the Clients remotely via the Management Tool, or the computers in your network are a part of a workgroup and do not have the same administrative account for each computer. Setting up Environment for Remote Installation Client Installation Prerequisites The majority of Client installation/uninstallation issues are caused by incorrect system or network settings. The following conditions have to be met for successful Client installation: The remote computer has to be online and accessible via network. Shared folders have to be accessible on the remote computer. Simple file sharing (Sharing Wizard) has to be disabled if the computer is in a workgroup (for domain computers this requirement can be skipped). You need to know the domain administrator or local administrator account credentials for the remote computer. The Server and the Remote Procedure Call (RPC) system services have to be running on the remote computer. Windows XP and Vista Firewall has to be properly set up on the remote computer during the Clients remote installation. In Windows 7, Windows 8, Server 2008 and Server 2012 Firewall, inbound connections have to be allowed in the Remote Service Management (RPC) rule for the remote computers and the File and Printer Sharing option has to be enabled (in this case it is not necessary to disable Windows Firewall). In Windows Firewall on the Server side, allow the Server executable to accept TCP connections via ports 3347 (for the connection between the Server and the Clients), 3349 (for the 75

76 connection between the Server and the Monitor), (for the connection between the Server and the Management Tool). NOTE: These rules will be added to Windows Firewall automatically if Windows Firewall is enabled during the Server installation. Make sure the conditions mentioned above are met to avoid possible problems with Client remote installation. Disabling Simple File Sharing in Windows XP To disable simple file sharing in Windows XP, do the following: 1. Open My Computer. 2. Select Tools > Folder Options in the menu. 3. In the Folder Options window, select the View tab. 4. Clear the Use simple file sharing check box. 5. Click Apply and OK to close the window. 76

77 Disabling Sharing Wizard in Windows 7, Windows 8 and Windows 8.1 To disable the Sharing wizard in Windows 7 and Windows 8/8.1, do the following: 1. Open the Folder options window: For Windows 7: Open Computer and then select Organize > Folder and search options. For Windows 8/8.1: Open the Control Panel and then select Appearance and Personalization. 2. In the Folder Options window, select the View tab. 3. Clear the Use Sharing Wizard check box. 4. Click Apply and OK to close the window. Checking System Services To check that the Server and Remote Procedure Call (RPC) system services are running: 1. Right-click Computer and select Manage. The Computer Management window opens. 77

78 2. Expand the Services and Applications node and select Services. To quickly access Windows Services, press Windows+R, type services.msc in the Run text box and press Enter. 3. Find the Server service and the Remote Procedure Call (RPC) service in the list of services. Make sure both services are running (their status is displayed as Started). 4. If one or both services are not running, start them manually. To start the service, right-click it and select Start from the context menu. The selected service is started. Setting up Windows Server 2003, Windows XP, and Windows Vista Firewall It is not necessary to disable the Firewall in Windows Server 2003, Windows XP, and Windows Vista. For successful remote installation of the Clients, you have to enable the File and Printer Sharing option. To set up Windows Server 2003, Windows XP, and Windows Vista Firewall, do the following: 1. Select Start > Control Panel > Windows Firewall. 78

79 2. In the Windows Firewall window, select the Exceptions tab. 3. On the Exceptions tab, select the File and Printer Sharing check box. 4. Click Ok. 79

80 Setting up Firewall for Windows Server 2008, Windows Server 2012, Windows 7, 8, and 8.1 It is not necessary to disable the Firewall in Windows 7, Windows 8, Windows 8.1, Windows Server 2008 and Windows Server For successful remote installation of the Clients, you have to allow inbound connections in the Remote Service Management (RPC) rule for the remote computers and enable the File and Printer Sharing option. To enable inbound connections for the Remote Management Service (RPC), do the following: 1. Select Control Panel > System and Security > Windows Firewall. 2. In the Windows Firewall window, click Advanced settings. 3. In the Windows Firewall with Advanced Security window, click Inbound Rules and then double-click the Remote Service Management (RPC) rule in the rules list. 4. The Remote Service Management (RPC) Properties window opens. 5. In the General tab, select Enabled under General and click Allow the connection under Action. 80

81 6. In the Advanced tab, under Profiles, select the profile of the network used for connecting remote computers and the Server. 81

82 7. Click Apply and then OK to save the settings and close the Properties window. 8. Close the Windows Firewall window. To enable the File and Printer Sharing option, do the following: 1. Select Control Panel > System and Security > Windows Firewall. 2. In the Windows Firewall window, click Allow an app or feature through Windows Firewall. 3. In the opened Allowed apps window, click Change settings. 82

83 4. Select the File and Printer Sharing check box. 5. Click OK. 83

84 Installing Clients Remotely via the Management Tool About You can install the Clients remotely via the Management Tool. This way of installation is very convenient if all computers in your network have the same domain administrator credentials. Remote Client Installation is performed by a user who has the Client installation and management permission in two steps: 1. Selecting computers on which Clients will be installed. 2. Defining installation parameters and installing the Clients. Selecting Computers To select the computers for Client installation, do the following: 1. Log in to the Management Tool as a user with the Client installation and management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, click Install Clients. 4. The Computers without Clients page opens. On this page, you can see the computers for which the previous installations failed. 5. Select how you would like to search for computers where the Clients will be installed: To select computers from the list of all computers in your network, click Add computers (network scan). To select computers by IP range (IPv4 or IPv6 addresses), click Add computers by IP. To select computers by their names, click Add computers by name. 6. In the Choose search results window: 84

85 Click Start new search to look for computers with defined parameters. Click Previous search results to choose the computers found in the previous search. If you haven t performed any searches yet, this button will be absent. 7. If you have selected the Add computers by IP option, the Computers Scan page opens. In the From Address and To Address boxes, enter the IP range (either IPv4 or IPv6) for which the network should be scanned. To find only one computer, enter the same IP address in both boxes. Click Scan. 8. If you have selected the Add computers by name option, the Computers Adding page opens. Enter the names of computers on which Clients must be installed in the box Name and click Add. Use semicolon to separate computer names. Please note that you should enter the full name of the computer. 9. The scanning process starts. The list of found computers will be updated automatically. If it is not updated, click Refresh. 10. When the scanning process finishes, select check boxes next to the computers that you want to install the Clients on. Click Next. 11. The selected computers are added to the list on the Computers without Clients page. 85

86 12. If you want to delete some computers from this list, click Remove from list next to the selected computer. Remote Client Installation Process When all computers for Сlient installation are selected, you are ready to start installation. Please make sure that all selected computers are correctly adjusted. To install the Clients remotely, do the following: 1. On the Computers without Clients page, click Install. 2. On the Client Configuration page, define the name/ip of the Server to which the Clients will be connecting, and define the Client configuration for the Clients you are installing. Click Next. NOTE: The Server IP address has to be static for Clients to connect to it successfully. Unique external IP addresses should be used for cloud-based Servers. 3. On the Installation credentials page, enter the credentials of a user with administrator permissions on the target computers for Client installation and then click Next. If the computers are in a domain, enter the domain name and domain administrator account credentials. If the computers are in workgroup, enter the credentials of a local administrator for target computers. If you leave the Domain box empty, the entered credentials will be used as the credentials of a local user of a target computer and the Client will be installed under the <target PC name>\<user name> account. NOTE: All workgroup computers must have the same administrator account credentials. Otherwise use installation via installation package method to deploy the Clients. 86

87 4. The installation process starts. The progress of installation will be updated automatically on the Client installation page. If it is not updated, click Refresh. 5. After the end of the installation, the installed Clients will appear on the Clients page in All Clients group. If the installation of some Clients fails, these computers will remain in the Computers without Clients list and you can click Retry to start the installation again. Remote Installation From an Existing.INI File If you already have an.ini file with defined settings generated in the Management Tool and saved to your computer, you can use it for installing the Clients. To install the Clients remotely, using an existing.ini file do the following: 1. On the Computers without Clients page, click Install using existing.ini file. 2. On the INI file selection page, click Choose file to select the.ini file that will be used for configuration of new Clients. Please note, if any parameter except RemoteHost is absent or not valid, its value will be set to default. The RemoteHost parameter is ignored in this type of installation. The Client will connect to the Server to which the Management Tool is connected. 3. Once the.ini file is chosen, click Next and continue the installation the same way as when installing the Clients remotely in a common way. 87

88 Installing Clients Locally About You can install the Clients locally using the Client installation file generated in the Management Tool. You have two options for downloading the Client installation file from the Management Tool: Generate the installation package and set the Client configuration during generation. Use Client installation file (.exe) to install the Client with default parameters. Client Installation Package The installation package consists of 2 components: A signed agent.exe installation file. An agent.ini text configuration file that contains the Client installation parameters defining the Server to which the Client will be connecting, and Client configuration. The table below lists all the Client installation parameters. If any parameter except RemoteHost is absent or not valid, its value will be set to default. NOTE: The Forced User Authentication parameter can be set only during Client editing. Parameter Description Default Value RemoteHost ColorDepth EnableTimer Timer A name or IP address of the computer on which the Server is installed. NOTE: The Server IP address has to be static for Clients to connect to it successfully. Unique external IP addresses should be used for cloud-based Servers. A color scheme used for screenshots saving. 7 4 bits (Grayscale), 8 8 bits, bits. Screenshots will be created with a certain time interval. If the value is 1, the option is enabled, if the value is 0 disabled. A period of screenshot creation in seconds. This period can t be less than 30 seconds. This parameter is needed if the EnableTimer parameter is set. No 7(4 bits (Grayscale)) Disabled 30 88

89 EnableActivity EnableWndNmChanges SmoothMode EnableKBandMouse A screenshot creation when an active window is changed. If the value is 1, the option is enabled, if the value is 0 disabled. A screenshot creation when a window name is changed. If the value is 1, the option is enabled, if the value is 0 disabled. A screenshot creation on each event without timeout. If the value is 1, the option is enabled, if the value is 0 disabled. WARNING! This parameter affects CPU usage on the Client computer and database size. A screenshot creation on clicking and a key pressing. If the value is 1, the option is enabled, if the value is 0 disabled. Enabled Enabled Disabled Enabled EnableProtectedMode The mode of Client work. If the value is 1, the protected mode is enabled, if the value is 0 disabled. Disabled EnableKeystrokes URLMonitoring MonitorTopDomain FilterState Logging of a keystroke. If the value is 1, the option is enabled, if the value is 0 disabled. Monitoring of URL addresses. If the value is 1, the option is enabled, if the value is 0 disabled. Monitoring of top and second-level domain names. If the value is 1, the option is enabled, if the value is 0 disabled. NOTE: This parameter works only if URLMonitoring=1. Application filtering during monitoring. If the value is disabled, the application filtering is disabled and all applications are monitored. If the value is include, the application filtering is enabled in the Include mode, and only applications listed in AppsFilterNames or AppsFilterTitles are monitored. If the value is exclude, the application filtering is enabled in the Exclude mode, and only Enabled Enabled Enabled Disabled 89

90 applications not listed in AppsFilterName or AppsFilterTitles are monitored. FilterAppName FilterAppTitle MonLogging LogPath EnableForcedAuth NotificationMessage The list of application names separated with comma (e.g., word.exe, skype.exe). Names are combined with OR logic; the LIKE operator is applied to names (e.g., if word.exe is written then winword.exe will be monitored). The list of application titles separated with comma (Facebook, Google). Names are combined with OR logic; the LIKE operator is applied to titles (if Facebook is written, then Facebook-Messages will be monitored). Creation of monitoring logs on the Client computer. 0 - monitoring logs creation is disabled, 1 - monitoring text log will be created in the LogPath location. The path to the monitoring logs location. Using environment variables (%appdata%, %temp%, etc.) is allowed. Additional identification of users that log in to the Client computer with server operation system. If the value is 1, the option is enabled, if the value is 0 disabled. The message that is displayed on user login to the system. Empty Empty Disabled C:\ProgramDa ta\censornet\ Desktop Surveillance\ MonLogs Disabled Disabled Generating Client Installation Package To generate an installation package, do the following: 1. Log in to the Management Tool as a user with the Client installation and management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, click Install Clients. 4. On the Computers without Clients page, click Download installation file. 90

91 5. On the Installation File Download page, click Generate Client installation package (*.ini + *.exe). 6. On the Generate Installation Package page, define the name/ip of the Server to which the Clients will be connecting, and define the client configuration to be applied to the Client and then click Next. NOTE: The Server IP address has to be static for Clients to connect to it successfully. Unique external IP addresses should be used for cloud-based Servers. 7. The installation package is successfully created and downloaded to your computer. The download settings depend upon the settings of your browser. Installing Clients Locally with Custom Monitoring Parameters To install the Client locally using the installation package, do the following: 1. Copy the package (the agent.exe installation file and the agent.ini file) to the target computer. 2. Start the agent.exe installation file under the administrator account on the target computer. 3. After the package is deployed, the name of the required computer appears on the Client Management page in the Management Tool. Downloading Client Installation File (.exe) To download the file for Client installation, do the following: 1. Log in to the Management Tool as a user with the Client installation and management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, click Install Clients. 4. On the Computers without Clients page, click Download installation file. 5. On the Installation File Download page, click Download default Client Installation (*.exe). 6. File downloading starts. The download settings depend upon the settings of your browser. Installing Clients Locally without.ini File This type of installation allows you to install the Clients with default configuration. This way you will need only the agent.exe file for Client installation. The agent.ini file with default parameters will be generated automatically. To install the Client locally using the installation package on the target computer: 91

92 1. Copy the downloaded agent.exe file to the target computer and do one of the following: Start the agent.exe installation file under the administrator account on the target computer. Then in the opened window, enter the name or IP address of the computer on which the Server is installed and after that click Install. In the Command Prompt (cmd.exe) started under administrator, enter agent.exe /ServerName=<Server Name>. 2. After the package is deployed, the installed Client appears in the list on the Client Management page in the Management Tool. Installation via Third Party Software If you want to install the Client via a third-party tool (e.g., via System Center Configuration Manager, Active Directory, etc.), download the Client installation file and use the following command: agent.exe /ServerName=<Server Name>. The Client will be installed with a default configuration. Cloning a Virtual Machine with Installed Client Each Client has its own unique ID, which it receives when it connects to the Server. When you prepare a virtual machine which is to be monitored, for cloning, you need to remove the Client ID to ensure the proper Client connection to Server. To remove the Client ID, do the following: 1. Make sure the Client is offline (doesn't have any connection with the Server). 2. Open the Windows Registry Editor. 3. In the Registry Editor window, select the following key HKEY_LOCAL_MACHINE\SOFTWARE\CensorNet\Desktop Surveillance\Client. 4. Double-click the AgentGUID value, or select it and click Modify in the right-click menu. 5. Remove the ID from the Value Data box. 6. Click OK. NOTE: You will not be able to edit the registry values in the Protected Mode. 92

93 Updating Clients The Client updating is performed automatically when a Client connects to the Server of a newer version. When the Client is updated, you will still be able to access its monitored data that was received before the update. NOTE: During the Client updating, the Client status in the Management Tool is offline. In some cases, if you install a newer version of the Server, Clients of very old versions will not be able to update. In this case you need to uninstall the old Client and install a new version of a Client manually. Reconnecting Clients to Another Server If you want to reconnect the Clients to another Server, start the remote installation from that Server. The Clients will be reconnected. Please note that this way of reconnection can be used only for the Clients that work in the nonprotected mode. If your Clients work in the protected mode, first disable the protected mode and then reconnect the Clients. Uninstalling the Clients About Client Uninstallation The Clients can be uninstalled locally or remotely. It is possible to uninstall the Client locally only with the help of the Uninstallation key. After remote uninstallation, the Client stops sending its data to the Server, but its data is not deleted from the Server and the Client is displayed in the Management Tool. After local uninstallation, the Client stops sending its data to the Server, but the Client is not marked as uninstalled on the Server. That is why the Client status in the Management Tool becomes offline after local uninstallation. To delete the Client from the Server (with all its captured data) and from the Management Tool, follow the steps described in the Deleting the Client section. Client Uninstallation Key During the Server installation, it is possible to define the Client Uninstallation key. By default, this key is allowed. The Client Uninstallation key is used during the local Client uninstallation. 93

94 The user is able to view or change the Client Uninstallation key in the Management Tool. If you change the Uninstallation key, the Client will receive it after connection to the Server. If the Client has not connected to the Server yet, then its Uninstallation key is allowed. If the Client has not connected to the Server after the Uninstallation key has been changed, the Client has to be uninstalled with the help of an old Uninstallation key. To change the uninstallation key, do the following: 1. Log in to the Management Tool as a user with the Client uninstallation permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, click Edit Uninstallation Key. 4. On the Custom Uninstall Key page, enter the new uninstallation key in the New Key field. 5. Re-enter the new uninstallation key in the Confirm Key field and then click Save. 6. The uninstallation key is changed. Uninstalling the Clients Remotely To uninstall one Client, do the following: 1. Log in to the Management Tool as a user that has the Client uninstallation permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, select the Client you want to uninstall and click Edit Client. 4. On the Editing Client page on the Properties tab, click Uninstall Client. NOTE: This button is not displayed if the Client is already uninstalled or you don t have the Client uninstallation permission for it. 5. In the confirmation message, click Uninstall. 6. The Client is uninstalled. To uninstall several Clients, do the following: 1. Log in to the Management Tool as a user with the Client uninstallation permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, select Uninstall Clients. 4. On the Client Uninstallation page, click Add Clients to list. 5. The page with the Clients for which you have the Client uninstallation permission, opens. 6. Select the Clients that you want to uninstall and click Next. To find a specific Client, enter its name or a part of its name in the Contains box and click Apply Filters. 7. Make sure you have added all necessary Clients to the uninstallation list and click Uninstall. 94

95 8. The selected Clients are uninstalled. Uninstalling the Clients Locally It is possible to uninstall the Client locally only with the help of the Uninstallation key that is defined during the Server installation or in the Management Tool. To uninstall the Client locally, do the following: 1. Run the Command Prompt (cmd.exe) as administrator. 2. In the Command Prompt, go to the Client installation folder. By default, it is located here: C:\Program Files\CensorNet\Desktop Surveillance. 3. Enter the following command: UninstallClient.exe /key=<uninstallation key>. 4. Press Enter. 5. The Client is successfully uninstalled. Viewing Clients Clients are displayed in groups on the Client Management page. If the user has an administrative Client installation and management permission, he/she will see all Clients. In other case, the user will see only those Clients for which he/she has at least one Client permission. The lists of Clients contain the following information: Client name Status Domain IPv4 IPv6 Description Please note, if there are several network cards on the Client computer, only those IPv4 and IPv6 addresses will be displayed in the Management Tool. You can filter Clients in the following ways: To find Clients by their host name or description, enter the name/description or a part of it in the Contains box and click Apply Filters. To hide offline/online/uninstalled/licensed Clients, select the corresponding option in the Filtering pane and click Apply Filters. To sort Clients in a group, click the column header. 95

96 On the Client Management page you have the following options: Add Client Group, Install Clients, Manage Licenses, Edit Uninstallation Key, Uninstall Clients, Delete Clients, Edit client configuration and Edit Client Groups. The number of available options depends upon permissions. Client Description Client description is used as additional information about your Clients, which makes it easier to find a specific Client. You can filter your Clients by their descriptions as well as by their names. Client description can be defined on the Editing Client page on the Properties tab. To edit the description for the Client, enter it in the Description box and click Finish. Client Configuration About Client Configuration includes its monitoring parameters (screen capture creation, keystrokes logging, Client mode, etc.). The Client configuration can be defined in the.ini file, which is included to the installation package. You can set the Client configuration during remote installation and during Client editing. NOTE: The Forced User Authentication parameter can be set only during Client editing. Protected Mode Parameter The Client can work in two modes: Non-protected mode: a regular mode without enhanced Client security. Protected mode: a mode with enhanced Client security: the user is not able to edit Client data (log files, generated screen captures), edit Client settings in the registry, edit/remove/modify/rename Client files (*.exe and *.dlls). The protected mode can be enabled when installing, updating, or editing the Client. If the protected mode is enabled during Client installation, this change will come into effect immediately. If the protected mode is enabled during Client editing, this change will come into effect after the computer is rebooted. NOTE: It is impossible to reconnect the Client working in protected mode to another Server. In such situation, you will have to uninstall the Client locally or change its mode to nonprotected. 96

97 Screen Capture Creation Parameters Screen captures are the main result of the Client monitoring activity. You can define the following parameters of Client screen captures: Screen capture color settings: By default, screen captures are grayscale with 4 bit color depth. This guarantees the smallest database size with a normal screen capture quality. You can set color depth to 8 bits or 24 bits. Screen capture creation frequency: These options allow you to define how often the screen captures on the Client computer will be created. Screen capture creation can be initiated by one of the following triggers: o Time interval: Screen captures are created with a certain time interval, irrespective to whether something changes on the screen or not. The minimal time interval is 30 seconds. o Active window change: Screen captures are created on the change of the active window. For example, a new window opens (program starts), a new tab in the browser opens, any secondary window opens, etc. (influences the keystroke logging as well). o Active window title change: Screen captures are created on the change of the name of the active window (influences the keystroke logging as well). o Clicking or key pressing: Screen captures are created on each mouse click or keyboard key pressing. Please note, the screen captures in this mode are sent not oftener than once in 3 seconds to avoid affecting the performance of the Client computer and database size increasing. o Each event without timeout: Screen captures are created on each mouse click or keyboard key pressing without using data sending time out. WARNING! The Capture screen on each event without timeout option affects CPU usage on the Client computer and database size. It is not recommended to use this option for a great number of Clients and for a long period of time. Keystroke Logging Parameters If keystroke logging is enabled, the Client logs keystrokes along with the screen capture creation. The Client logs the following types of keystrokes: Character keys: Keys that contain alphabet symbols (upper or lower case), numerals (0-9), all kinds of punctuation symbols, and space. Modifiers: This group of keys includes Control key, Shift key, Alt key, and Windows key. Navigation and typing modes: The arrow keys, Home/End, Page Up/Page Down, Tab, Insert, Delete/Backspace, Enter, and Lock keys (Num Lock, Scroll Lock, and Caps Lock). System commands: Print Screen, Menu, Escape, and Break/Pause key. 97

98 Function keys: Keys that perform some functions, such as printing or saving files. Usually, they are labeled as F1- F12 and are located along the top of the keyboard. Monitoring Log Parameter Monitoring logs are text files created on the Client computer. Monitoring logs can be of two types: User actions log: The log name is Client_<yyyy_mm_dd>.log. The log includes information on all monitored activities on the Client computer. The following information is written to this log: Activity time, Session ID, Client computer name (Host name), User name, Activity title, and Application name. User logging in log: The log name is Login_<yyyy_mm_dd>.log. The log includes information on all user logs in on the Client computer. The following information is written to this log: Login time, Client computer name (Host name), and User name. NOTE: The monitoring log feature can be used for the integration with SIEM systems (e.g., ArcSight). Both logs are created in the user defined location. You can use the environment variables (%appdata%, %temp%, etc.) when defining the path. If this location is not accessible or write-protected, logs are saved to <systemdisk>\programdata\censornet\desktop Surveillance\MonLogs. If you change the log files location via the Management Tool, the new log files will be created in the defined location and the old log files (if any) will remain in the previous location. NOTE: Please don`t confuse monitoring logs with Client activity logs (service logs for internal use) stored in <client installation folder>\activitylogs. Parameters examples:.ini File Parameters Parameters Set in Management Tool Don t create monitoring logs [ActivityLogsParameters] MonLogging=0 LogPath= On the Monitoring options tab, make sure that the Enable creating log files of the monitored events check box is not selected. 98

99 Create monitoring logs in the default location %ProgramData%\CensorNet\Desktop Surveillance\MonLogs [ActivityLogsParameters] MonLogging=1 LogPath= On the Monitoring options tab, make sure that the Enable creating log files of the monitored events check box is selected. Create monitoring logs in the C:\1\Logs folder [ActivityLogsParameters] MonLogging=1 LogPath=C:\1\Logs On the Monitoring options tab, do the following: 1. Select the Enable creating log files of the monitored events check box. 2. In the Log files creation field, type C:\1\Logs. Create monitoring logs in the <current user profile>\appdata\ Desktop Surveillance_Logs [ActivityLogsParameters] MonLogging=1 LogPath=%AppData%\Desktop Surveillance_Logs On the Monitoring options tab, do the following: 1. Select the Enable creating log files of the monitored events check box. 2. In the Log files creation field, type =%AppData%\Desktop Surveillance_Logs. URL Monitoring Parameters The URL monitoring option enables recording the text entered in the browser address line at the moment of screen capture creation and allows the investigator to receive information about websites visited by the user of the Client computer. This feature also allows you to set an alert to send notifications each time when the user opens the forbidden URL. The URL address is displayed in the Monitor in the Activity title column and is treated as a part of the activity title. There are several restrictions for the URL monitoring option in the current version of the program: Only URLs from the standard browsers (Firefox, Chrome, Opera, Safari, and Internet Explorer) are monitored. For the first version, URLs from Metro Internet Explorer are not monitored. URLs entered in web anonymizers are not monitored. Please note that proxy server anonymizers are supported. 99

100 If there is no address line in the browser (e.g., due to user s settings), URLs are not monitored. Unicode symbols in domain names (e.g., Russian) are not monitored. If the Enable URL monitoring option is selected in the Management Tool, you can also select the Monitor top and second-level domain names only option. In this case only the main part of the URL (e.g., example.com) will be monitored. Parameters examples:.ini File Parameters [AgentParameters] URLMonitoring=0 MonitorTopDomain=0 [AgentParameters] URLMonitoring=1 MonitorTopDomain=0 [AgentParameters] URLMonitoring=1 MonitorTopDomain=1 Parameters Set in Management Tool On the Editing Client page, on the Monitoring Options tab, clear the Enable URL monitoring check box. On the Editing Client page, on the Monitoring Options tab, select the Enable URL monitoring check box. On the Editing Client page, on the Monitoring Options tab, select the Enable URL monitoring check box, then select the Monitor top and second-level domain names only check box. Example of monitored data (activity title) John Doe - Google Chrome John Doe - Google Chrome (URL: John.doe) John Doe - Google Chrome (URL: Application Filtering Parameters Application filtering allows you to reduce the amount of information received from the Client by defining applications whose data will be skipped during the monitoring. The Application filtering can be in one of three states: 100

101 Disabled: User activity in all applications is monitored (screen captures are created and keystrokes are logged). Include: User activity in predefined applications is monitored. Information on all other activity is skipped. This mode allows you to enable monitoring only of the important applications. Exclude: User activity in all applications except predefined ones is monitored. This mode allows you to skip information about user activity in non-suspicious applications (for example, Word). The applications are identified by name or window title. Both parameters are combined with OR logic, i.e., if activity meets at least one of conditions, it s recorded in the Include mode or skipped in the Exclude mode. Parameters examples:.ini File Parameters Parameters Set in Management Tool Monitor all data without applying filters [FilterParameters] FilterState=disable FilterAppTitle= FilterAppName= On the Application Filtering tab, in the Filter State box, select Disabled. Monitor only data from all applications containing words Facebook or Gmail in the title [FilterParameters] FilterState=include FilterAppTitle=Facebook,Gmail FilterAppName= On the Application Filtering tab, do the following: In the Filter State box, select Monitor only activity matching defined parameters. In the Active window title contains box, type Facebook, Gmail. 101

102 Monitor only data from all applications containing words Firefox or Internet in the application names [FilterParameters] FilterState=include FilterAppTitle= FilterAppName=Firefox,Internet On the Application Filtering tab, do the following: 1. In the Filter State box, select Monitor only activity matching defined parameters. 2. In the Application name contains box, type Firefox, Internet. Monitor only data from applications containing words Firefox, Chrome or Internet in the application names (any title) and applications with word Facebook in the title (any name) [FilterParameters] FilterState=include FilterAppTitle=Facebook FilterAppName=Firefox,Chrome,Internet On the Application Filtering tab, do the following: 1. In the Filter State box, select Monitor only activity matching defined parameters. 2. In the Active window title contains box, type Facebook. 3. In the Application name contains box, type Firefox, Chrome, Internet. Monitor all data except data from applications containing words Work or Doc in the title [FilterParameters] FilterState=exclude FilterAppTitle=work,doc FilterAppName= On the Application Filtering tab, do the following: 1. In the Filter State box, select Monitor all activity except. 2. In the Active window title contains box, type Work, doc. Monitor all data except data from applications containing words Word or Excel in the application names [FilterParameters] FilterState=exclude FilterAppTitle= FilterAppName=word,excel On the Application Filtering tab, do the following: 2. In the Filter State box, select Monitor all activity except. 3. In the Application name contains box, type Word, Excel. Monitor all data except data from applications containing word Word in the application name or word doc in the title 102

103 [FilterParameters] FilterState=exclude FilterAppTitle=doc FilterAppName=word On the Application Filtering tab, do the following: 1. In the Filter State box, select Monitor all activity except. 2. In the Active window title contains box, type doc. 3. In the Application name contains box, type Word. Forced User Authentication Parameter Forced User Authentication provides a method for an additional identification of users that log in to the Client computer. This feature can be enabled only for Clients installed on computers with server OS and it cannot be set during Client installation. If the Enable secondary user authentication on log-in option is selected in the Management Tool, the Client will display the additional login window on the user login to Windows. NOTE: Forced User Authentication can only be set during Client editing in the Management Tool. Additional Message on User Login Parameter Additional message on user login allows you to inform the user that his/her session is monitored and also inform him/her about the important issues related to the corporate policy or the country s laws. If the Enable displaying additional message option is selected in the Management Tool, the Client will display the additional notification message on the user login to Windows. After the user confirms acknowledging the message, he/she will be allowed to log in and continue working. For more information, see the Additional message on user login chapter. Editing Client Configuration You can edit the Client configuration for online and offline Clients. The configuration for online Clients will be applied immediately. The configuration for offline Clients will be applied as soon as the Client is online. To edit the Client configuration, do the following: 103

104 1. Log in to the Management Tool as a user with the Client configuration management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, select the Client for which you want to edit the configuration, and click Edit Client. To find a specific Client, enter its name in the Contains box and click Apply Filters. NOTE: If you don t have the Client configuration management permission for this Client, the configuration options will be disabled. 4. On the Editing Client page, on the Properties tab, define the description for the Client (optionally). Then select the Enable protected mode check box if you want to enable protected mode. NOTE: The Client mode will be changed after reboot of the Client computer. 5. On the Screen Capture Options tab, define the required screen capture quality and screen captures creation frequency. WARNING! The Capture screen on each event without timeout option affects CPU usage on the Client computer and database size. It is not recommended to use this option for a great number of Clients and for a long period of time. 6. On the Monitoring Options tab, do the following: Select the Enable keystroke logging check box to enable the keystroke logging. 104

105 Select the Enable creating log files of the monitored events check box to enable creation of monitoring logs on the Client computer and define log files location. Select the Enable URL monitoring check box to receive information about websites visited by the user of the Client computer. Select the Monitor top and second-level domain names only check box to monitor only the main part of the URL (e.g., example.com). 7. On the Application Filtering tab, define the filtering parameters for the Client. 8. On the Authentication options tab, do the following: For Clients installed on the computer with server operation system, select the Enable secondary user authentication on log-in check box if you want to enable the additional authorization for users that log in to the Client computer. 105

106 Select the Enable displaying additional message check box if you want to enable additional message on user login, and then enter the message to be displayed to a user. 9. After defining the configuration, click Next to proceed to defining Client Groups to which the Client belongs and permissions on working with it or click Finish to except changes. 10. A new configuration will be immediately applied to the Client. Viewing Client Configuration Client configuration can be viewed by a user that has an administrative Client installation and management permission or any Client permission. To view Client configuration, do the following: 1. Log in to the Management Tool. 2. Click the Client Management navigation link on the left. 3. On the Clients page, select the required Client and click Edit Client. 4. In the opened window you will see the tabs with the corresponding configuration parameters. Defining Client Configuration for All Clients in a Group Client configuration can be changed for all Clients in the group simultaneously. These settings will change the current settings of Clients but will not be applied to any new Clients added to the corresponding group. To change Client configuration for All Clients in a Group, do the following: 1. Log in to the Management Tool as a user with the Client configuration management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, select the required Client Group and click Edit Client Group. 4. On the Group Properties tab, click Configure Clients in group. 5. Edit configuration to be applied to all Clients in the group on the corresponding tabs in the same way as when editing configuration for one Client. 6. When all configuration parameters are defined, click Finish. 7. A new configuration will be immediately applied to all Clients in the group. 106

107 Client Group Management About Client Groups Client Groups allow you to grant access to several Clients at the same time to your users without the necessity to grant them access to all the Clients. By default, there is one Client Group in the system, which contains all installed Clients. You cannot remove Clients from this group. NOTE: One Client can belong to several groups. Adding Client Groups To add a new Client Group, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, click Add Client Group. 4. On the Group Properties tab, define the name for the Client Group and optionally define its description. Click Next. NOTE: The maximum length of the Client Group name and description is 200 characters. 5. On the Client Management tab, select the Clients that will belong to the Client Group and then click Next. To find a specific Client, enter its name in the Contains box and click Apply Filters. 6. On the Permissions tab, select users/user groups which will have access to the Client Group and define their permissions: To find a specific user/user group, enter its name in the Contains box and click Apply Filters. To define user/user group permissions, click Define Permissions for the required users/user groups and select the check boxes near the corresponding permissions in the opened Client Permissions window. After you have defined all permissions, click Save. NOTE: Permissions inherited by the user from user groups to which he/she belongs are displayed as disabled check boxes with a user group name near them. 7. When permissions for all users are defined, click Finish on the Permissions tab. 8. The Client Group is created. 107

108 Editing Client Groups To edit an existing Client Group, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, click Edit Client Group for the required Client group. 4. Edit Client Group properties and permissions on the corresponding tabs in the same way as when adding a new Client group. NOTE: Click Next or Finish to save the changes on each tab. 5. The Client Group is edited. Deleting Client Groups If you delete a Client group, the Clients belonging to it will not be deleted, but the permissions of users defined for the deleted Client Group will change. The All Clients group cannot be deleted. To delete a Client Group, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, click Edit Client Group for the required Client group. 4. On the Group Properties tab, click Delete Client Group. 5. In the confirmation message, click Delete. 6. The Client Group is deleted. Forced User Authentication on Client About If the Client is installed on the computer with server OS (Windows Server 2003, 2008, or 2012) and several users may use the same account to log in to this computer, it is important to identify the person using the account. The identification can be performed by means of Forced User Authentication, which requires the user to enter additional credentials in the pop-up dialog after logging in. The secondary login will then be displayed in the Monitor in brackets next to the primary login under which the user is logged in to Windows. The forced user authentication feature works only if there is a connection between the Client computer and the Server computer. If the connection with the Server computer is lost (the 108

109 Server is unavailable), the pop-up dialog for entering secondary credentials will not be displayed. NOTE: In some situations (e.g., after the forced restart) the Client service doesn t start during one minute after the computer turning on. In these situations forced authentication will not work. Enabling Forced User Authentication on Client The Forced User Authentication parameter can be set only during Client editing and is available only for the Clients installed on the computers with server OS. To enable Forced User Authentication on the Client, do the following: 1. Log in to the Management Tool as a user with the Client configuration management permission. 2. Click the Client Management navigation link on the left. 3. On the Clients page, select the Client for which you want to enable Forced User Authentication, and click Edit Client. To find a specific Client, enter its name in the Contains box and click Apply Filters. 4. On the Editing Client page, on the Properties tab, select the Enable secondary user authentication on log-in check box. 5. Click Finish. 6. If the Client is installed on Windows Server 2003, the computer restart is required after enabling or disabling the forced authentication mode. On Windows Server 2008 and 2012, the forced authentication mode is enabled immediately. 109

110 Granting the User Permission to Log In To grant a user a permission to log in to the Client computer with server OS and enabled forced user authentication, do the following: 1. Log in to the Management Tool as a user with the administrative User management permission. 2. Add the Active Directory or internal user which will log in to the Client computer, to the system. 3. Click the User Management navigation link on the left. 4. On the Users page, click Edit User for the required user. To find a specific user, enter its name in the Contains box and click Apply Filters. 5. Open the Client Permissions tab and click Edit Permissions for the required Client. To find a specific Client, enter its name in the Contains box and click Apply Filters. 6. In the opened Client Permissions window, select the Login to Client computer check box and then click Save. Logging In If the Enable secondary user authentication on log-in option is selected for the Client in the Management Tool, only users with the Login to Client computer permission will be able to work on the Client computer. The process of logging in to the Client computer with enabled forced user authentication is performed as follows: 1. The user logs in to Windows in a common way (locally or remotely). 2. On the user login to Windows, the Client displays the secondary authentication window requesting a user to enter his/her credentials. 3. The user enters the credentials of the user created in the Management Tool that has a Login to Client computer permission. 4. These credentials are sent to the Server and the Server returns the response on whether the access to this computer is allowed. If the user has the required permission and his/her entered credentials are correct, the user is allowed to continue working with the System. In other case, the user will receive a corresponding message. 5. As soon as the user starts working with the system, the Client will start writing his/her activity and the user`s name will be displayed in the Monitor in the User name column in brackets: <logged in Windows user> (<forced authentication user>). 110

111 Additional Message on User Login About If you want the user to be informed that his/her session will be monitored, you can enable this option in the Management Tool and set the message to be displayed to a user. The user must confirm acknowledging the message in order to log in to the computer. Screen captures are not created by the Client until the user clicks I agree in the notification message. If the user doesn t click I agree, he/she will be returned to Windows login screen and will not be able to continue working with the system. The additional message is displayed when: Windows is started, restarted, or shut down. The user gets logged out or switched. The user logs in via the remote connection. If both forced user authentication and additional message features are enabled for the Client, the additional message will be displayed after the user enters his/her additional credentials in the secondary authentication window. NOTE: The additional message is not displayed for unlicensed Clients. Enabling Displaying Additional Message The additional message displaying can be enabled when editing Client/Client Group configuration and defining the Client settings during the remote installation or Client installation package generation for local installation. By default, the additional message text is: According to company policy you must agree to the terms in order to continue working on this computer. You can enter the custom message to be displayed to users. NOTE: The message can be up to symbols. To enable displaying the additional message when installing the Client, select the Enable displaying additional message check box on the Client configuration page (if the Client is to be installed remotely) or on the Generate Installation Package page (if the Client is to be installed via the installation package). When the Client is installed, the user will receive the default notification message on his/her login until the text of the message is changed when editing the Client. To enable displaying the additional message when editing the Client, do the following: 1. Log in to the Management Tool as a user with the Client configuration management permission. 2. Click the Client Management navigation link on the left. 111

112 3. On the Clients page, select the Client for which you want to edit the configuration, and click Edit Client. To find a specific Client, enter its name in the Contains box and click Apply Filters. 4. On the Authentication options tab, select the Enable displaying additional message check box, and then optionally enter the message to be displayed to a user. 5. Click Finish. Logging In The process of logging in to the Client computer with enabled additional message option is performed as follows: 1. The user logs in to Windows in a common way (locally or remotely). 2. On the user login to Windows, the notification message is displayed. 3. If the user clicks I Agree, he/she is allowed to continue working with the system. If the user clicks Cancel, he/she returns to the Windows login screen. NOTE: If the user logs in to the computer with Server operation system on which forced user authentication is enabled, he/she enters credentials in the additional authentication form and then the additional message is displayed. 112

113 Alerts About Alerts Alerts are instances that notify the investigator of a specific activity (potentially harmful/forbidden actions) on the target computers on which Clients are installed and allow the investigator to respond to such activity quickly without performing searches. The notifications can be received in or Monitor tray. Besides, screen captures generated on alert events are marked as alert in the Monitor. Alert system can be used for two purposes: Immediate response: This allows the investigator to get immediate information about the forbidden action and respond to it quickly (almost at once). Delayed response: This allows the investigator to get information on a batch of forbidden actions on multiple clients, analyze them, and then respond. Viewing Alerts The alerts are displayed on the Alert Management page in the Management Tool. The list of alerts contains the following information: Name Description Clients/Client Groups to which the alert is assigned Alert State: Indicates if the alert is enabled. Type Notification: Indicates how the investigators are notified about alert events (by s or via Monitor Tray). Recipient: The address of the investigator who will be notified about alert events. To find a required alert, you can use a filtering option on the top of the page. On the Alert Management page, you can add new alerts, edit existing alerts (including deleting), and define Global Alert Settings. 113

114 Alerts Management Adding Alerts To add an alert, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Alert Management navigation link on the left and click Add Alert. 3. On the Add Alert page, on the Alert Properties tab, enter a unique name for the created alert and then optionally enter its description and select the Enabled check box. Click Next. 4. On the Alert Rules tab, define the rules to be applied and then click Next: Select the Parameter of the rule. Select the Comparison operator. Enter the Value to which Parameter will be compared. Click Add to create one more rule. To delete a rule, clear its Value box. 114

115 5. On the Assigned Clients tab, select the Clients/Client Groups to which the alert will be assigned and click Next. To find specific Clients/Client Groups, enter their names in the Contains box and click Apply Filters. 6. On the Notification Options tab, select how you would like to receive the alert notifications: In the s field, enter the address to which the notifications will be sent. You can enter several addresses, separating them with semicolon. NOTE: To receive notifications correctly, make sure that Sending Settings contain correct parameters for sending. Select the Show warnings in Desktop Surveillance Monitor tray check box to activate the tray notifications. The alert notifications will then pop up from the tray on all computers with started Monitor. 7. Click Finish to save the created alert. 115

116 8. The alert is added. Rules Alert rules allow you to determine what events on the investigated computer will be considered an alert. Each alert has to have at least one rule. When several rules are defined for the same parameter (Application name/user name/window title) within one alert, the alert will work if the conditions of at least one rule are met. For example: Rule 1. Application name is skype.exe Rule 2. Application name is winword.exe The alert will work if the user launches either Skype or Word. When the rules are defined for the different parameters within one alert, the alert will work if all of the rules are satisfied. For example: Rule 1. Application name is skype.exe Rule 2. User name is Nancy The alert will work only if the user Nancy launches Skype. When you have multiple rules defined for one parameter and one rule defined for the other parameter, the alert will work if conditions of any rule from the first group and the condition of the rule defined for a different parameter are met. For example: Rule 1. Application name is skype.exe Rule 2. Application name is winword.exe Rule 3. User name is Nancy The alert will work only if the user Nancy launches Skype or user Nancy launches Word. Rules are defined for a certain alert when adding or editing an alert. Each rule consists of the Parameter, Comparison operator, and Value, to which the Parameter will be compared. The following parameters are available for the rules: 116

117 Parameter Description Example Application The name of the started application on the investigated computer. Set this parameter type for alert to be activated whenever the specified value is identified as the name of a launched application. skype.exe Title The name that appears in the title of a window. Set this parameter type for alert to be activated whenever the specified value is identified in any title on the screen. If the URL monitoring option is enabled for the Client, the Title parameter will be applied not only to window titles, but also to URL addresses. My document or facebook.com Login The name of the Windows user whose work is to be monitored. Set this parameter type for alert to be activated whenever the specified user uses the computer on which the Client is installed. If forced user authentication is enabled and the secondary user login matches the user name alert parameter, the Client marks corresponding events as an alert. For example: The alert parameter is Login LIKE John. The user logs in to Windows as Guest and then enters John as the secondary login. Screen captures from this user (Guest (John)) are marked as alert. John Comparison operators: Equal to: The defined value fully corresponds to the found result (e.g., John will find John, but will not find Johny) Like: The found result includes the defined value (e.g., John will find Johny, Johnatan, but will not find Johan) Rule Examples 1. To set up the alert notification about any user opening the facebook.com site on the investigated computer, select the Title parameter and, in the Value field, enter facebook.com. NOTE: URL monitoring must be enabled. 117

118 2. To set up the alert notification about any user opening the page/document containing the word Facebook in the title on the investigated computer, in the Value field, enter Facebook: 3. To set up the alert notification about a specific user (e.g., Stefan) opening Facebook on the investigated computer, enter the following parameters: If you enter more than one name, the alert notification will then appear if any of them (Stefan or Rick) opens Facebook. 118

119 4. To set up the alert notification about any user launching skype.exe application on the investigated computer, enter the following parameters: 5. To set up the alert notification about a specific user (e.g., Stefan) launching skype.exe application on the investigated computer, enter the following parameters: 119

120 If you enter more than one name, the alert notification will then appear if any of them (Stefan or Rick) launches skype.exe. 6. To set up the alert notification about a specific user (e.g., Stefan) using the investigated computer, enter the following parameters: 120

121 Enabling/Disabling Alerts If you don`t need to receive notifications on a specific alert which you don`t want to delete, you can disable it in the Management Tool by clearing the Enabled check box on the Alert Properties tab of the Edit alert page. This option can be enabled again later, by selecting the Enabled check box on the same page. Editing Alerts To edit an alert, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Alert Management navigation link on the left. 3. Click Edit alert for the required alert. 4. Edit alert properties and rules on the corresponding tabs in the same way as when adding a new alert. NOTE: Click Next or Finish to save the changes on each tab. 5. The alert is edited. Assigning Alerts to Clients To assign an alert to a specific Client, do the following: 1. Log in to the Management Tool as a user with an administrative Client installation and management permission. 2. Click the Alert Management navigation link on the left. 3. Click Edit alert for the required alert. 121

122 4. On the Assigned Clients tab, select the Client to which the alert will be assigned and click Next. To find specific Client, enter its name in the Contains box and click Apply Filters. 5. Click Finish to save the changes. 6. The alert is assigned to the selected Client. Deleting Alerts To delete an alert, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Alert Management navigation link on the left. 3. Click Edit Alert for the required alert. 4. On the Alert Properties tab, click Delete Alert. 5. In the confirmation message, click Delete. 6. The alert is deleted. Defining Global Alert Settings Global Alert Settings allow you to define notification settings for all alerts. Their editing is available for users with the administrative Client installation and management permission. These settings are applied to all alerts and to all Monitors connected to this Server. To define Global Alert Settings, click Global Alert Settings on the Alert Management page. 1. Frequency Settings The Frequency settings group allows you to define how frequently the alert notifications will appear in the Monitor Tray and be sent via . Minimal interval between notifications sent for the same alert event. This option defines how frequently the notifications about the same alert event will appear. For example, if this parameter is set to 10 minutes and a user has started Skype and works in it, the investigator will receive one notification every 10 minutes instead of receiving 10 notifications every minute or even more. Define how often the notification will be sent: - Send notifications on every alert event option allows you to notify the investigator on every alert event. - Send batch notification every (min) option allows you to notify the investigator about all alert events that occurred during defined time interval. Time counting starts when the Server starts if this option is selected. Notifications are then sent with the defined frequency. 122

123 2. Tray Notification Journal Settings The Tray notifications journal group contains only one parameter that allows you to define the maximum number of events displayed in the Tray Notification Journal. When it is reached, the oldest records are removed from the journal of all Monitors (but not from the database). To receive alert notifications via , define Sending Settings. 123

124 Alert Notifications About Monitor Tray The Monitor Tray is a special utility that notifies the investigator about the alert events on the investigated computers. This utility is automatically installed on the computer where the Monitor is installed. The alerts are displayed in the pop-up notifications from the Windows tray area. The notifications may be set up to be displayed immediately or with a delayed response in the Global Alert Settings accessible from the Management Tool. Left-click the tray icon opens the latest notification in the Monitor. Right-click the tray icon opens the context menu. It contains the following options: Disable/Enable Tray Notification: Disables or enables the pop-up notifications from the Windows tray. Open Tray Notifications Journal: Opens the journal containing the records of the latest notifications on alerts on the investigated computers. Stop the Monitor Tray Service: Terminates the work of the utility. NOTE: To enable automatic launch of the Monitor Tray service at system startup, you need first to log in to the Monitor at least once. Tray Notifications Journal Tray Notifications Journal keeps the records of the latest alert notifications from the investigated computers. The maximum number of the records in the Tray Notifications Journal is defined by the investigator in the Global Alert Settings in the Management Tool. When it is reached, the oldest records are removed from the journal. The records can be cleared by clicking the Empty Journal button. NOTE: Information removed from the journal is not deleted from the database. Information is displayed in the grid containing such columns: Alert: Displays the alert name. Host: Displays the name of the computer on which the alert event occurred. User: Displays the name of the user logged in to the computer on which the Alert event occurred. Time: Displays the time when the alert event occurred on the investigated computer. Activity Title: Displays the name that appeared in the title of a window when the alert event occurred on the investigated computer. Application: Displays the name of the started application on the investigated computer when the alert event occurred on the investigated computer. 124

125 Hyperlink: Displays the link to the alert screen capture in the Monitor. Left-click it automatically launches the Monitor and takes the investigator to the alert screen capture. Data in all columns can be sorted by clicking on the column header. 125

126 Advanced Reports About The user activity can be analyzed with the help of reports generated via the Management Tool. These reports allow you to receive the information on the activity of multiple Clients, alert events, and detected URLs, and get statistics on time spent by the user in each application or on each web-page. You can schedule the reports to be generated and sent via at the specified time or manually generate the reports, which can be saved or printed, via Report Generator. The reports can be generated in any of the following formats: PDF (*.pdf), Web Page (*.html), Single File Web Page (*.mht), Rich Text Format (*.rtf), Plain Text (*.txt), Excel Workbook (*.xlsx), Excel Workbook (*.xls), XPS Document (*.xps), and CSV Document (*.csv). Report Types The following types of reports are available in the Management Tool: Grid reports Report type Contains the information about Consists of the following columns Contains the information on Alert Grid Report All alert events on all selected Clients for the defined users and defined time interval. Activity time Alert name Activity title Application name Keystrokes Clients and users of Client computers 126

127 Report type Activity Summary Report URL Summary Report Contains the information about Time spent by the user in each application (by application name) for the defined users and defined time interval. Time spent by the user on each site (by domain name) for the defined users and defined time interval. Summary reports Consists of the following columns Application Time spent (hrs) URL only the main part of the URL (e.g., example.com) will be added to the report. Time spent (hrs) Contains the information on Clients and users of Client computers Clients and users of Client computers NOTE: Any user activity that lasts less than 10 seconds will not be included into the report. Chart reports Report type Contains Consists of the following data Contains the information on Activity Chart Report The same information as in the Activity Summary Report, but in the form of a bar chart. Application title Total time spent (minutes) Users of Client computers Activity Pie Chart Report The same information as in the Activity Summary Report, but in the form of a pie chart. Application title Time spent in the application (%) Users of Client computers URL Chart Report The same information as in the URL Summary Report, but in the form of a bar chart. URL only the main part of the URL (e.g., example.com) will be added to the report. Total time spent (minutes) Users of Client computers URL Pie Chart Report The same information as in the URL Summary Report, but in the form of a pie chart. URL only the main part of the URL (e.g., example.com) will be added to the report. Time spent on the website (%). Users of Client computers 127

128 NOTE: The time spent by the user on a certain site or in a certain application is calculated basing on the time difference between the screen capture with the current user activity and the screen capture with another user activity. To enhance the accuracy of time calculation, disable the application filtering option and make sure that all screen capture options are selected in the Management Tool. Scheduled Reports About The Management Tool allows creating reports via Report Scheduler and sending them the defined addresses with the defined time interval. The reports creation is available to the user with the administrative Client installation and management permission. The report creation and sending options are defined in rules, which include the following parameters: rule name and description, report type and format, state (enabled or disabled), generation frequency (daily, weekly, or monthly), Clients/Client groups, and Users on Clients to which the rule must be applied. The created rules are displayed on the Scheduled Reports page in the grid with the following columns: Name Description Assigned To Monitored Users State Frequency Recipients Adding Report Rules To add a rule, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Scheduled Reports navigation link on the left and click Add rule. 3. On the Add rule page, on the Rule Properties tab, enter a unique name for the created rule and then optionally enter its description and select the Enable scheduled report generation check box. Click Next. 4. On the Report Options tab, do the following and then click Next: Select one or several Report Types. Define the Report Parameters: o In the Report format field, select the format for the report. o In the Generate report filed, select the frequency of report generation (Daily, Weekly, or Monthly). 128

129 o In the Start report generation at field, define the time at which the report generation must be started. NOTE: Depending upon the Server load, the report generation can start a few minutes later than the set time. You can select the value from the drop-down list and edit it manually if you need to set your own number of minutes. If the Weekly parameter is selected in the Generate report field, select the day of the week on which the report will be generated in the Day of week drop-down list. If the Monthly parameter is selected in the Generate report filed, select the day of the month on which the report will be generated in the Day of month dropdown list. NOTE: If the Monthly parameter is selected and you want the report to be generated on the 31 st day of the month, it will be generated only in those months where there are 31 days. Define the custom header and footer for the report in the Header text and Footer text fields (the maximum length of the header and footer text is 1000 symbols). Enter the addresses to which the report will be sent in the s field. NOTE: Define the Sending Settings to receive the scheduled reports via On the Assigned Clients tab, select the Clients/Client Groups to which the rule will be applied and click Next. To find specific Clients/Client Groups, enter their names in the Contains box and click Apply Filters. 3. On the Monitored Users tab, define the users whose activity will be included in the report. To select a certain user, click the Add Users button, then on the Adding Users page, select the check boxes next to the corresponding users and click Add selected. NOTE: Only those users whose activities have already been monitored are listed on the Adding Users page. 4. Click Finish. 5. The rule is added. NOTE: The scheduled report rule can also be created by clicking the Create Scheduled Report Rule button on the Report Generator page. Editing Report Rules To edit a rule, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Scheduled Reports navigation link on the left. 3. Click Edit Rule for the required rule. 4. Edit rule properties, report options, and define assigned Clients and monitored users on the corresponding tabs in the same way as when adding a new rule. NOTE: Click Next or Finish to save the changes on each tab. 5. The rule is edited. 129

130 Deleting Report Rules To delete a rule, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Scheduled Reports navigation link on the left. 3. Click Edit Rule for the required rule. 4. On the Rule Properties tab, click Delete Rule. 5. In the confirmation message, click Delete. 6. The rule is deleted. Generating Reports from the Scheduled Report Rule Once the scheduled report rule is created, you can generate a report from the Rule Properties tab any time. To generate a report from the Scheduled Report Rule, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Scheduled Reports navigation link on the left. 3. Click Edit Rule for the required rule. 4. On the Rule Properties tab, click the Generate Report button. 5. The generation of the report starts. 6. The report can be viewed on the Scheduled Reports Generation Log page as soon as it is generated. If the s field contains one or more addresses defined in the rule, the report will be sent to those addresses. NOTE: If the generated report is not displayed on the Scheduled Reports Generation Log page, it is still being generated. Reload the page by pressing the F5 key until the report is displayed. Frequency and Time Interval for Report Creation The time interval of the data that is added to the report depends upon the report generation frequency. If the report is generated on a daily basis, it will include the data that was monitored starting from the specified time of the previous day up till the specified time of the current day. For example: If the Daily parameter is set and the report is to be generated on June, 13 at 17:00, the time interval of the data for this report will start on June, 12 at 17:00 and end on June, 13 at 17:

131 If the report is generated on a weekly basis, it will include the data that was monitored starting from the specified time and day of the previous week up till the specified time and day of the current week. For example: If the Weekly parameter is set and the report is to be generated on Monday at 18:00, the time interval of the data for this report will start on Monday of the previous week at 18:00 and end on Monday of the current week at 18:00. If the report is generated on a monthly basis, it will include the data that was monitored starting from the specified time and day of the previous month up till the specified time and day of the current month. For example: If the Monthly parameter is set and the report is to be generated on January, 20 at 19:00, the time interval of the data for this report will start on December, 20 at 19:00 and end on January, 20 at 19:00. NOTE: If the Monthly parameter is selected and you want the report to be generated on the 31 st day of the month, it will not be generated in those months where there are 30 days or less. If the monthly report is set to be generated on the 31 st day of month, but there were less than 31 days in the previous month, the time interval of the data for this report will start on the last day of the previous month and end on the 31 st day of the current month. For example: If the report is generated on March, 31, the time interval of the data for this report will start February, 28 or February, 29 and end on March, 31. If the report is generated from the scheduled report rule, the time interval of the data for the report will depend upon the current date and time. For example: If the Daily parameter is set in the rule and the Start report generation parameter is set to 15:00, and you want to generate the report at 14:00, the time interval of the data for the report will start from 14:00 of the previous day and end at 14:00 of the current day. If the Weekly parameter is set in the rule and the Day of week parameter is set to Wednesday, and you want to generate the report on Friday at 12:00, the time interval of the data for the report will start from Friday of the previous week at 12:00 and end on the current day at 12:00. If the Monthly parameter is set in the rule and the Day of month parameter is set to the 15 th day of month, and you want to generate the report on May, 10 at 10:00, the time interval of the data for the report will start from April, 10 at 10:00 and end on the current day at 10:

132 Viewing Logs For each rule, the user can see the log which contains the information on time when the report was generated, report name (file name) and type, report generation result (status), number of results in the report, and the s to which the report was sent. NOTE: Only 100 last records are stored. To view the logs, do the following: 1. Log in to the Management Tool as a user with the administrative Client installation and management permission. 2. Click the Scheduled Reports navigation link on the left. 3. Click View Log for the required rule. 4. On the Scheduled Reports Generation Log page the logs are displayed in the grid with the following columns: Generated (Time when the report was generated) File Name (Report name) Report Type Status (Finished, In Progress, or an error reason in case the error occurred during report generation) Results Count (Number of results in the report) Sent To 5. Click the Download link to download the report to your computer. Report Generator About The reports can be generated on the Report Generator page by the user with the Viewing monitoring results permission and can be previewed before printing. The main difference between Report Scheduler and Report Generator is that Report Generator allows you to create reports for the time interval of any length. Though it may take you much time to generate a report for a long time interval and for a big number of Clients. NOTE: You can generate only one type of report at a time via Report Generator. Report parameters The following parameters are defined in the Management Tool when creating a report: 1. Report parameters 132

133 This option allows you to select the type of the report and enter its custom Footer text and Header text. 2. Date filters This option allows you to define the time interval for which the report will be generated. 3. Clients This option allows you to select the Clients/Client groups, whose monitored data will be added to the report. NOTE: Only Clients for which the user has the Viewing monitoring results are displayed. 4. Users This option allows you to select the users of Client computers whose activity will be included in the report. Generating Report To generate a report, do the following: 1. Log in to the Management Tool as a user with the Viewing monitoring results permission. 2. Click the Report Generator navigation link on the left. 3. Define the report parameters: Select the type of the report and enter its Footer and Header text. In the From and To fields, enter the dates and time within which the data of the monitored Clients should be added. Click Add Clients and on the opened Adding Clients page select the check boxes next to the corresponding Clients/Client groups. Once the Clients are selected, click the Add selected button. Define the users whose activity will be included in the report: o Select the Any user option if you don t need to specify the user whose activity will be added. o In other case, select the Selected users option, click Add Users, and then select the check boxes next to the corresponding users on the opened page. Once the users are selected, click the Add selected button. NOTE: Only those users whose activities have already been monitored are listed. 4. Click Generate Report. 5. On the opened Report Preview page, click the corresponding icons located on the toolbar above the report to perform the following actions: Display the search window Print the report Print the current page Export a report and save it to the disk 133

134 Export a report and show it in a new window when this icon is clicked, the report is opened in a new window, from which it can be saved to the disk, printed, or zoomed. You can also navigate between the pages of the report by clicking the blue arrows and choose the format of the report by clicking the black arrow that opens a drop-down list with all supported formats. Creating a Scheduled Report Rule from the Report Generator Page Once the parameters for the report are defined, you can create a scheduled report rule basing on the defined parameters. To create a rule, do the following: 1. Log in to the Management Tool as a user with the Viewing monitoring results permission. 2. Click the Report Generator navigation link on the left. 3. Define the report parameters. 4. On the Report Generator page, click the Create Scheduled Report Rule button. 5. The Editing Rule page opens. 6. On the Rule Properties tab, enter a unique name for the created rule and then optionally enter its description. The default name of the rule is GeneratorRule<number of rule>. 7. Click Next. 8. On the Report Options tab, enter the corresponding values in the Report Parameters fields and the s field the same as when adding a new report rule. The other parameters like Report Type, Header and Footer text, Clients, and Users were defined in Report Generator, but you can edit them if you want. 9. Click Finish. 134

135 System Configuration Defining Sending Settings sending settings allow you to define the options of sending notifications for all alerts and receiving reports via . Their editing is available for users with the administrative Client installation and management permission. sending settings can be defined on the Alert Management page and on the Scheduled Reports page. The settings include: 1. Connection Settings Server: This option allows you to define an existing SMTP mail server. NOTE: The delivery of notifications via mail servers with only NTLM authentication, such as Microsoft Exchange Server, is not supported. Port: This option allows you to define the server port number via which the s will be sent. Encrypted connection type: This option allows you to define the type of encrypted connection via which the notifications will be sent. You can choose between: - None - SSL - TLS 2. Connection Credentials This option allows you to define the login details (User and Password) of an existing account from which the notifications will be sent. If the mail server does not require entering any credentials, you can select the No authentications check box. 3. Connection Test This option allows you to send a test to a specified address to check if all connection settings are correctly defined. 135

136 Monitor About The Monitor is a program for viewing and analyzing the screen captures and the corresponding keystrokes received from Clients. The review of screen captures is available in the form of video. The alert monitoring function of the Monitor is accessible via Monitor Tray. The Monitor application is accessible for all internal users and Active Directory users that were added in the User list of the system. The monitoring results that are displayed in the Monitor are accessible only for those users that have the Viewing monitoring results permission for Clients. Installing/Uninstalling/Updating the Monitor Installing the Monitor The Monitor can be installed on any computer, but a network connection to the Server is required for the Monitor to operate. To install the Monitor, do the following: 1. Run the DesktopSurveillance_Components.exe installation file. 2. On the Welcome page, click Next. NOTE: If you have the Server installed on this computer, the setup wizard will offer to add or remove components and the installation procedure will differ a bit. 3. Carefully read the terms of the End-User License Agreement and click I Agree. 4. On the Choose Components page, do one of the following and click Next: In the drop-down list, select Monitor. Select Desktop Surveillance Monitor in the box. 5. Do one of the following to define the destination folder for the application and click Next: Click Browse and in the Browse For Folder window, define the destination folder. Enter the destination folder in the corresponding field. 6. On the Choose Start Menu Folder page, do one of the following and click Install: Define the name for the program folder in the Start Menu. Select Do not create shortcuts to not create the program shortcuts. 7. The process of installation starts. Its progress is displayed on the Installing page. 8. After the end of the installation process, click Finish to exit the wizard. 136

137 Updating the Monitor The updating of the Monitor is performed via the installation file of a newer version. To update the Monitor, do the following: 1. Run the DesktopSurveillance_Components.exe installation file. 2. On the Welcome page, click Next. 3. On the Already Installed page, select Update/Add/Remove components and click Next. NOTE: If you have the Server and the Monitor installed on the same computer, you will need to select to update the Server as well, otherwise it will be removed. 4. On the Choose Components page, select Desktop Surveillance Monitor and click Next. 5. The updating process starts. 6. After the end of the updating process, click Finish to exit the wizard. Uninstalling the Monitor Uninstallation of the Monitor can be performed in 2 ways: If the Monitor is installed on the same computer with the Server, you can uninstall it via the DesktopSurveillance_Components.exe installation file. If the Monitor is installed alone on a separate computer, you can uninstall it via the Windows Control Panel. To uninstall the Monitor that is installed on the same computer with the Server: 1. Run the DesktopSurveillance_Components.exe installation file. 2. Click Next on the Welcome page. 3. On the Already Installed page, select Add/Remove components and click Next. 4. On the Choose Components page, clear the Monitor check box and click Next. 5. The setup wizard removes the unselected components. 6. After the end of the uninstallation process, click Finish. To uninstall the Monitor that is installed alone on a separate computer: 1. Open the Windows Control Panel and navigate to the Programs and Components page. 2. Select Desktop Surveillance in the programs list and click Uninstall/Change on the toolbar. 3. On the Uninstall Desktop Surveillance page, click Uninstall. 4. Wait for the setup wizard to complete uninstallation and click Finish to exit the wizard. 137

138 Working with the Monitor Running the Monitor To run the Monitor, do the following: 1. Click the icon of the Monitor to start it. 2. In the Login window, enter the following parameters and click OK: Server: Enter the Server IP address or name. Type localhost if the Server is installed on the same computer with the Monitor. Login: Enter the user login. It can be <user name> if you are logging in as an internal user or <domain name>\<windows user name> if you are logging in as an Active Directory user. Password: For an internal user, enter the password that was defined during the user creation. For an Active Directory user, enter the Windows user password. If you want to log in to the Monitor automatically, select the Remember Server location and user credentials check box to save the entered data. 3. The user is logged in to the Monitor and can start viewing the Client sessions. NOTE: All users can log in to the Monitor, but only users that have Viewing monitoring results permission assigned in the Management Tool can view the data received from Clients. Changing the User in the Monitor Connecting or disconnecting the Monitor from the Server allows you to change the user. To change the user, do the following: 1. In the main menu, select File - Change user or press Ctrl + D. 138

139 2. In the Login window, enter the user credentials, Server name, and define the Remember Server location and user credentials check box state. Then click OK. 3. The user is changed. Monitor Interface Monitor Interface By default, the Monitor interface is divided into the following areas: Main menu: Provides you the access to Monitor features. Search management area: Allows you to perform quick and parameterized searches. History pane: Displays the current and favorite searches. Results pane: Displays the detailed results of the search. Player pane: Displays the list of screen captures, the keystrokes, the URL addresses, and screen captures themselves. Details pane: Allows you to view the keystrokes associated with the selected screen capture and URL addresses of websites visited by a user. Screen capture viewer: Allows you to view screen captures made from the computer on which the Client is installed, in the form of video. 139

140 Main Menu The main menu of the Monitor provides the access to the features of the program. The main menu consists of three parts: File menu View menu Help menu File menu The File menu consists of five options: Change user: Allows you to change the Monitor user. Save screen capture: Allows you to save the screen capture selected in the Player area. Report: Allows you to generate two types of reports. Export video file: Allows you to export the screen captures from the session to a video file format. Exit: Allows you to exit the Monitor. View menu The View menu consists of four options that allow you to hide/display panes: History: Allows you to hide/display the History pane. Results: Allows you to hide/display the Results pane. Player: Allows you to hide/display the Player pane. Keystrokes: Allows you to hide/display the Keystrokes sub-pane in the Player pane. 140

141 Help menu The Help menu consists of two options: Help: Provides you the access to this help file. About: Provides you with the information about the Monitor application. Panes History pane In this pane, the Search list tree-view structure is displayed: Current search: This folder contains the parameters and results of the current search. Saved searches: This folder contains the saved user search parameters. Results pane In this pane, the search results are displayed. The search results fields are filled when the search finishes. The results are displayed in a grid with the following columns: User name: The name of the user logged in to the Client computer. If Forced user authentication is enabled, the forced user authentication login will be displayed in brackets next to the name of the target computer user. Host name: The name of the computer on which the Client is installed. It corresponds to the Client name in the Management Tool. Type: The session type (Live or Finished). Start: The date and time when the session started. Last activity: The date and time of the last made screen capture. Finish: The date and time when the session finished. If the session has the Live status, this field is empty. Client Group: The groups the Client belongs to. Please note, if the Client belongs only to a default All Clients group, the column will be empty. Player pane The Player pane is divided into three areas: the list of screen captures (to the right), the screen capture viewer (to the left), and the Details pane (below the list of screen captures). The list of screen captures is displayed in a grid with the following columns: 141

142 Alert icon: Indication whether the screen capture was triggered by an alert event. Activity time: The date and time when the screen capture was made. Activity title: The name of the active window that is associated with the screen capture and the URL address (if any) entered in the browser address line. Application name: The name of the application that was started on the Client computer. You can change the size of the columns. Data is sorted by the time of the screen capture creation. Viewing Monitored Data Viewing Screen Captures The Monitor allows you to view the screen captures made from the computer on which the Client is installed. You can view them separately by selecting the required screen capture from the list or viewing all screen captures in the form of video. To view the screen captures, do the following: 1. In the Results pane, select the required session. The maximum duration of one live session can be 24 hours. 2. The list of all screen captures from the session is displayed in the form of grid in the right part of the Player pane. 3. The Player is not playing by default. To move from one screen capture to the next one, use the Previous/Next control buttons. To start playing screen captures, in the 142

143 list of screen captures, select the screen capture starting from which you want the video to be streamed. In the Player area, click Play. 4. You can do one of the following while viewing screen captures: To pause/stop the video, use the corresponding Pause and Stop control buttons in the Player area. You can define the speed with which screen captures will change in the Player area. To do this, click Video speed and in the drop-down list, select Actual to display screen captures depending on their creation time; select 1/2/4/8/16 frame(s) per second to define the speed of screen captures playing. To open the screen capture to the full-screen mode, double-click the screen capture in the Player area. To enlarge certain parts of the screen capture, use the Magnifying glass control button and then move the rectangle across the screen capture. Viewing Live Sessions The Monitor allows you to view screen captures in a Live session (i.e., the monitoring of the Client computer is still in progress). Each Live session is terminated at 00:00. As soon as the session has been terminated, a new Live session automatically starts. To start playing a live session, click the Live button in the Player area. Then the list of screen captures will be refreshed each second and new screen captures will be added to the table if any are available. NOTE: If you click this button, you will not be able to navigate between screen captures in the list. Live sessions status in Search results will not change automatically to Finished until you perform another search. 143

144 NOTE: If you are viewing the session of the Client with the enabled Capture screen on each event without timeout option, it may affect CPU usage and cause performance slowdown due to the great number of received screen captures. Viewing URL Addresses If the URL monitoring option is enabled for the Client, then each time when the screen capture is created while the user is working in the browser, the URL address is saved and displayed next to the window title information in the Monitor. If there are several screenshots created while the user is viewing one page on a certain website, then all of them contain the same URL information. The URL address is displayed in brackets in the Activity title column next to the active window title and in the Details pane, under the keystrokes associated with the selected screen capture. 144

145 NOTE: As getting a URL address to be monitored may take about 600 milliseconds, there is a possibility that the screen capture and its activity title along with URL address may be not properly synchronized in the Monitor (e.g., the user may see a screen capture with a URL address that belongs to the previous one). Viewing Keystrokes When you select a screen capture, the keystrokes associated with it are displayed in the Details pane, below the list of screen captures. By default, it displays only text characters. You can enable displaying all keystrokes logged (e.g., navigation keys, functions keys, etc.) by clearing the Show only text characters check box. Then any other keys and key combinations will be displayed in inequality sign brackets. If a key was pressed repeatedly, it will be displayed with an "x" sign and the number of reiterations (e.g., <F12 x 24>). If the user types the text, using arrows (left/right) and Backspace or Delete keys, these keys are processed by the system to edit the logged keystrokes. When the keystrokes are edited, only the end result of text that was meant to be typed by the user is displayed in the Details pane. To see this result, the Show only text characters check box must be selected. For example: If the user types Helo and then uses the left arrow to go back and correct the word by typing another l, the word Hello will be displayed in the Details pane, instead of Helol. Presentation of keystrokes with the selected Show only text characters check box. 145

146 Presentation of keystrokes with the unselected Show only text characters check box. Please note that if the SmoothMode parameter is (a screenshot creation on each event without timeout) is enabled for the Client, the keystrokes are not edited. If the user corrects the word with a mouse, the keystrokes are not edited. For example: If the user types Fried and then uses the mouse to go back and correct the word by typing letter n, the word Friedn will be displayed in the Details pane, instead of Friend. 146

147 If the user types the text in different applications, the logged keystrokes are split according to screen captures. For example: If the user types Hello in Skype and then opens Word and types Ok, the word Hello will be displayed next to the screen capture associated with Skype, and the word Ok will be displayed next to the screen capture associated with Word, instead of HelloOk. NOTE: If the Enter key was pressed during input, the log will be split in the list of screen captures. Though to maintain text integrity, in the keystrokes box, the keystrokes lines having the same Title-Application pair will be put together. 147

148 Viewing Sessions of Clients with Enabled Forced User Authentication If Forced User Authentication is enabled on the Client installed on the computer with server OS, the user name is displayed in the User name column in brackets as follows: <logged in Windows user> (<secondary authentication user>). If there has been no secondary authentication, there are no brackets. Receiving Information on Alert Events The investigator can receive information on alert events in three ways: In the Monitor, the alert events are marked with a special icon. 148

149 If notifications are enabled in the Alert Parameters, the alert information can be received in the alert notification that also contains the link for viewing this alert in the Monitor. NOTE: You need the Monitor to be installed in order to be able to use links in the notifications. If the tray notifications are enabled in the Alert Parameters, the information can be displayed by clicking the View in the Monitor link in the pop-up notification from the Monitor Tray. Alternatively this information can be received from the Tray Notifications Journal called from the Monitor Tray context menu. Search About Searching You can perform searches in the Monitoring results. You can search by the following parameters: name of the screen capture, the application name, user, name of the computer with installed Client, date of the session start, date of the session finish, date of the last made screen capture, and type of the session. Please note that only the sessions of the Clients for which you have the Viewing monitoring results permission will be displayed in your search results. There are two types of searching: Quick: Allows you to perform searching by any text data. Parameterized: Allows you to perform searching using multiple parameters. 149

150 Quick Search The quick search allows the user to perform searches by the text data, i.e., by the name of the application, the activity title, user name, host name, keystrokes, and the name of the Client group. The quick search is enabled by default. NOTE: If the search request contains the dot (.) symbol, the system searches each text string located before and after dot (.) separately. For example, if the search request is google.com, the system will show results with google and com separately, i.e., the system will find google.com, facebook.com, google.co.uk, etc. To perform a quick search, do the following: 1. In the Search management area (under the Main menu), click the arrow near the Search button and select Quick search. 2. In the Search box, enter the required data by which you want to perform searching. 3. Click the Search button or press Enter. 4. The search starts. 5. When the search finishes, the results are displayed in the Results pane. 6. Click the session in the Results pane to view the detailed information in the Player pane. Parameterized Search The parameterized search allows you to perform searching in the sessions using multiple parameters. To perform a parameterized search, do the following: 1. In the Search management area (under the Main menu), click the arrow near the Search button and select Parameterized search. 150

151 2. The parameterized search area opens. 3. By default, there is only one search condition. To add another condition, click the plus button. The new condition line will be displayed below the first one. NOTE: Search conditions on data of one type are combined with OR logic. Search conditions on data of different types are combined with AND logic. 4. Define the search parameters. 5. When adding the Start, Finish time, or Last Activity time condition, the Now option is available. Select this option to perform the search till the current computer date. 6. When all parameters are defined, click the Search button or press Enter. 7. The search starts. When the process of searching finishes, the results are displayed in the Results pane. 8. Click the session in the Results pane to view the detailed information in the Player pane. Parameterized Search Parameters The parameterized search condition consists of the Parameter box, the Comparison operator box, and the Value box. You can add up to 10 conditions. To add the condition, click the plus icon. To delete the condition, click the minus icon. The conditions of different types are connected with "AND" logic; it means that each specified condition will be TRUE for each found session in the Results pane. The conditions of the same type are connected with OR logic; it means that at least one of the specified conditions of the same type will be TRUE for each found session in the Results pane. Text data parameters Search Item Description Example User name The name of the Windows user whose work is to be monitored. John 151

152 NOTE: If Forced user authentication is enabled for the Client, the search by the user name parameters is performed by both initial and secondary logins. Host name The name of the computer on which the Client is installed. Kenny Type The type of the session. The following types are available: Finished (the session is finished) and Live (the session is running). Finished, Live Title The name associated with the screen capture. It associates with the currently opened window on the investigated computer, context menu, etc. If the URL monitoring option is selected, the Title parameter will allow you to perform searches by URL. Start menu Application The name of the started application on the investigated computer. explorer.exe Client Group The name of the Client Group to which the Client belongs. My Group 1 Alert name The name of the alert that occurred on the investigated computer. Facebook alert Keystrokes A word that was typed on the investigated computer. Corporate Comparison operators for text data: 152

153 equal to: the defined value fully corresponds to the found result (e.g., John will find John, but will not find Johny); like: the found result includes the defined value (e.g., John will find Johny, Johnatan, but will not find Johan); Date parameters Search Item Comparison Operator Example Start time The date of the session start. 9/13/2014 Last Activity time The date of the last made screen capture. 12/13/2014 Finish time The date of the session finish. 12/12/2014 Additional options: Now: Select this option to enable the searching till the current date. Comparison operators for dates: equal to: the specified date fully corresponds to the found result (e.g., 12/12/2014 will find 12/12/2014 but will not find 12/11/2009); before: the found results will match all the dates till the specified one (e.g., 12/12/2014 will find 07/08/2009 but will not find 15/12/2014); after: the found results will match all the dates after the specified one (e.g., 12/12/2014 will find 13/12/2014 but will not find 11/12/2008). Saving Search Parameters You can save the search parameters to make it easier to perform further searches. The search parameters will be saved in the Saved searches folder in the History pane. The saving of search parameters is available only for the parameterized search. To save the search parameters, do the following: 1. Define the search parameters. 153

154 2. Click the Save search icon. 3. In the Saved Search window, enter the name for the set of the search parameters and click OK. 4. The search parameters are added to the Saved searches folder. You can view them in the History pane. 154

155 NOTE: When opening search parameters that include dates (Finish time, Start, or Last activity time) with the enabled Now option, the date will be set as the current one. Restoring Search Parameters You can restore the saved search parameters. This makes it easier to perform further searches without defining the same parameters again. To restore the search parameters, do the following: 1. In the History pane, navigate to the Saved searches folder in the Search list tree. 2. In the Saved searches folder, select the required folder with the saved search parameters. 3. The saved search parameters are displayed in the Search management area. 4. Click the search button or press Enter to start searching. Examples of Search Parameters 1. To find all screen captures connected with the work of Firefox.exe, enter the following parameters: 2. To find all finished sessions, enter the following parameters: 155

156 3. To find all sessions started on October 14, 2014 and finished on October 14, 2014, enter the following parameters: 4. To find all sessions related to a certain website (e.g., facebook.com), enter the following parameters: 5. To find all sessions related to a certain active window title, enter the following parameters: 6. To find all sessions related to the discussion of corporate policy, enter the following parameters: 7. To find all sessions of Clients which belong to a specific group, enter the following parameters: 8. To find all sessions related to the events that triggered an alert, enter the following parameters: Moving Between Search Results in Session If the search conditions included the Activity title and Application name parameters, the additional control buttons are displayed in the Player area. They are marked blue and allow moving between the found search results in one session. 156

157 Reports About Reports You can generate a report to export search results to a separate file. The report is generated in the *.xls format. The following two types of reports are available: Search Results report: This type of report includes information on all found sessions. The following data is included: number of found sessions, search type, date of the report generation, types of sessions, host names, activity time, and number of screen captures. Report can also include detailed information on each found session. Session Activity report: This type of report includes information on the user activity in one or more sessions. NOTE: You can also use the Advanced Reports option in the Management Tool to generate reports in different formats and with different kinds of information about user activity. Search Results Report Search Results report includes information on all found sessions. The following information is included to the report: date of report generation, path to the report, type of the search, number of found sessions, types of sessions (live or finished), names of the investigated computers, activity time, etc. If the user performed parameterized search, search parameters and their values are also included to the report. 157

158 The report can also include detailed information for each found session. Information on each session is displayed in a separate tab named <number>session. It includes general information on the session and the table with the names of screen captures, their creation date and time as it is displayed in the list of screen captures in the Player pane. To generate the Search Results report, do the following: 1. In the main menu, select File - Report - Search Results Report or right-click the session in the Results pane and select Report - Search Results Report. NOTE: The report can be generated for more than one session. Multi-selection is available in the Results pane. 2. The Search Results Report window opens. 3. In the Options, select the required options. The following options are available: Open generated report: Select this option to automatically open the report after the generation process finishes. Add detailed information for each session: Select this option to include detailed information for each session to the report. 4. In the Path box, do one of the following: Enter the path to the generated report manually. Click Browse and define the location for the file with the generated report. 5. Click Generate to generate the report. 6. When the generation process finishes, click Finish. The report will open automatically if the corresponding option was selected. 158

159 Session Activity Report The Session Activity report includes general information on the user activity in the session currently opened in the Player pane. Also, detailed information on the session activity is displayed in a separate tab named <hostname><date and time of the session start>. NOTE: The user can use Ctrl and Shift keys to select more than one session in the Results pane. In this case, the report will include detailed information on each selected session. To generate the Session Activity report, do the following: 1. In the Results pane, select one or several sessions. 2. In the Main menu, select File - Report - Session Activity Report or right-click the session and select Report - Session activity report. 3. The Session Activity Report window opens. 4. Select the Open generated report option to automatically open the report after the generation process finishes. 5. In the Path box, do one of the following: Enter the path to the generated report manually. Click Browse and define the location for the file with the generated report. 6. Click Generate to generate the report. 7. When the generation process finishes, click Finish. The report will open automatically if the corresponding option was selected. 159

160 Exporting Video Exporting a video means exporting screen captures of the session in the video format to your computer. A video is exported in the *.avi format. A video resolution will be the same as the resolution of the screen captures received from the Client computer. NOTE: You need to have codecs installed on your computer. To export a video, do the following: 1. Select the target session in the Results pane. Then do one of the following: Select File - Export Video File from the main menu or right-click the session in the Results pane and select Export video file. Select one or more captures in the Player Management pane, right-click them and select Export video file. NOTE: You can export the whole session as well as a part of it. To select screen captures for exporting, use Ctrl and Shift keys. 2. The Export Video window opens. 160

161 3. In the Video codec drop-down list, select the required codecs with the help of which a video will be created. Please note that the list contains only the system codecs that will be used for video creation. 4. Click Configure to configure the selected codec. Configuration window depends on the selected codec. 5. In the Screen capture displaying period group of options, select the speed with which a video will play. The following options are available: Real: A video will play with a real speed depending on the frequency of created screen captures. Custom: Define the time interval in seconds with which screen captures will change in the video file. 6. In the Export to box, do one of the following: Enter the path to the video file manually. Click Browse and navigate to the location for the exported video file. 7. Click Export video to export the session. 8. When the export process finishes, click Finish. 9. Navigate to the folder with exported data. NOTE: If there was a change of resolution on the Client computer display or change of bit depth on screen captures during the session, several video files might be exported. 161

162 Saving Screen Captures You can save the required screen capture to a file on your computer. Screen captures are saved in the *.png format. To save the screen capture, do the following: 1. In the Player pane, in the list of screen captures, select the required screen capture. 2. It is displayed in the Player window. 3. Right-click the screen capture and select Save screen capture or in the main menu, select File - Save screen capture. 4. In the Save As window, define the name and location for the screen capture. Click Save. 5. The screen capture is saved. 6. Navigate to the folder with screen capture. NOTE: You cannot save the screen capture if the video is playing or if there is a full-screen mode. 162

163 Troubleshooting Database/Server Database/Server Related Issues Issue I cannot start the Server from the Server tray. There are too many records in the database. I have defined a new database, what happened to the old one? I need to transfer the data from an old database to a new one/i want to change the type of the database without losing data. I have transferred the SQL database to another computer. I have changed the location of the Firebird database. I have installed a new version of the Server and I want to use the old database. I have used the database cleanup feature, but the size of the database didn t change. Cause/Solution To start the Server, the Server tray service must be started under the administrator account. Use the automatic or manual database cleanup feature to remove the old records from the database. To do this, in the Management Tool, click the Database Management navigation link and define the cleanup settings on the corresponding tabs. The old database remains in place and is not changed. Unfortunately, the data cannot be transferred from one database to another. Unfortunately, you can t relocate the SQL database to another computer. Though you can move it to another location on the same PC with SQL means. To redefine the location of the Firebird database, move it to another location and change its values in the Windows Registry Editor. See Moving the Server Database chapter for more details. If you have updated the Server, your old database will remain. If you have reinstalled the Server, you need to use a new database. The cleanup feature only removes data from the database, but doesn t change the size reserved by it. To reduce the size of the database, click Shrink database on the Database Options tab on the Database Management page of the Management Tool. 163

164 I have accidentally removed the database from the MS SQL Server. You need to define a new database. To do this, you need to reinstall the Server. I cannot shrink the database: the Shrink database button is absent in the Management Tool on the Database Options tab. Make sure you use the MS SQL Server database. The shrinking cannot be performed if the cleanup procedure is in progress. My anti-virus blocks the Server uninstallation/update. Due to the uninstaller specifics some anti-viruses might detect it as a false positive during virus scan. In this case, it is recommended to disable your anti-virus during Server uninstallation/update. Database/Server Related Error Messages The following table provides the list of error messages related to databases and the Server and their causes and possible solutions. These messages may appear in the Management Tool, from the Server tray service, or during the installation of the Server. Message Cause/Solution If you get the following message in the Management Tool: "Connection with MS SQL database is lost. Please check that the database is accessible and try again." The Server has lost the connection to the MS SQL Server. Please make sure that the MS SQL Server is running and it is online and accessible. To check that the MS SQL Server computer is accessible, enter the following command in the Windows command line: ping <name of the MS SQL Server computer> The connection to the MS SQL Server is blocked by the Firewall. Try disabling the Firewall on the MS SQL Server side. If you get the following message when trying to restart the Server service: Not enough permissions to restart the Server. You can restart the Server service only under the administrator account. If you get the following error while trying to clean up the database: "Error The program encountered an unexpected error while trying to 164

165 occurred while clearing the database. Please try again." If you get the following message from the Server tray service: "The Server connection with the database has been lost. Click to view logs." If you get one of the following messages while trying to perform an action with database: "An error occurred when shrinking database. Please try again." "Error occurred while retrieving database info. Please try again." clear the database. Try clearing the database again. Make sure the Server service is running. There was a problem with connection to the database. Please make sure that the computer on which the database is installed is online and accessible. To check that the computer is accessible, enter the following command in the Windows command line: ping <name of the computer with installed database> If the problem comes up again, please, send us logs (the Server Service file), which you can find in the Server sub-folder of the Desktop Surveillance installation folder. The Server has lost the connection to the database. Please make sure that the computer on which the database is installed is online and accessible. To check that the computer is accessible, enter the following command in the Windows command line: ping <name of the computer with installed database> If the problem comes up again, please, send us logs (the Server Service file), which you can find in the Server sub-folder of the Desktop Surveillance installation folder. The program encountered an unexpected error while trying to perform an action with database. Please try performing the action again. There was a problem with connection to the database. Please make sure that the computer on which the database is installed is online and accessible. To check that the computer is accessible, enter the following command in the Windows 165

166 command line: ping <name of the computer with installed database> If the problem comes up again, please, send us logs (the Server Service file), which you can find in the Server sub-folder of the Desktop Surveillance installation folder. Management Tool Management Tool Related Issues Issue HTTP 500 Internal Server error is displayed when I try to connect to the Management Tool. Cause/Solution For Windows 7, follow these instructions: 1. Make sure that all the following check boxes are selected in the Windows Features window: Net Framework 3.5> Windows Communication Foundation HTTP Activation and Windows Communication Foundation non-http Activation. 2. Run the Command Prompt (cmd.exe) as administrator: Enter %windir%\microsoft.net\framework\v4.0.xxx xx\aspnet_regiis.exe iru (for 32 bit machine) or %windir%\microsoft.net\framework64\v4.0. xxxxx\aspnet_regiis.exe iru (for 64 bit machine). Example: C:\Windows\Microsoft.NET\Framework64\v \aspnet_regiis.exe iru 3. Press Enter. For Windows 8.0 or 8.1, make sure that all the following check boxes are selected in the Windows Features window: Net Framework 3.5> Windows Communication Foundation HTTP Activation and Windows Communication Foundation non-http Activation. 166

167 The license management function is unavailable and I cannot add server/workstation licenses to Clients. I have no Internet connection on the computer with the installed Server and cannot activate serial keys. Make sure you have the administrative Client installation and management permission. If you have this permission, but the license management function is still unavailable, then your copy of the program is not licensed. Please purchase serial keys and activate them online or activate them on your vendor s license site and add them offline. You can activate the serial on the license site of your vendor and then add activated keys on the computer with the installed Server. I have reinstalled/updated the Server and now there are no activated serial keys in it. If you activated serial keys online, after you reinstall or update the Server, activated serial keys will be automatically synchronized. For this purpose, you need to have an active Internet connection during the first start of the Server. If you used an offline activation (added activated serial keys), you need to add them in the Management Tool again. The list of the domain computers is empty during the Client installation. The list of the domain computers is not complete during the Client installation. The target computer is out of the domain. This problem can be caused by network or Windows issues (e.g., your computer cannot connect to the local network). If there are no network problems, try searching for computers via the Add computers by IP option. To install Clients in such a way, on the Computers without Clients page click Add computers by IP. Desktop Surveillance obtains the list of domain computers using standard Windows methods, which do not always provide the full list of computers. If DNS settings of your computer network allow, you can: Search for computers using the Add computers by IP option. To install Clients in such a way, on the Computers without Clients page, click Add computers by IP. Create an installation package and install a Client locally on the target computer. To generate an installation package, on the Computers without Clients page, click Download installation file and then select the type of the installation file you want to download. When the installation file is 167

168 downloaded to your computer, you can start the installation process. I have assigned a server license instead of a workstation license to the Client or I have assigned a license to the wrong Client. There are some Clients that I did not install. I do not receive notifications, although the parameters are correct. Some of the Management Tool functions are unavailable. I do not want to provide the user with access to all Clients. I forgot the password of the internal user. The user is able to perform actions that are supposed to be prohibited for him/her (e.g., the user sees the Clients that he/she doesn t have a permission for). I haven t received any reports or alert notifications by . Any license can be anytime unassigned from a Client. These may be old Clients that were installed earlier. You can uninstall them remotely via the Management Tool or locally on the Client computer. Make sure you do not use Microsoft Exchange Server 2010, which is not supported. Make sure that you have the corresponding permissions for these functions. By defining the Client permissions for the user in the Management Tool, you can define which Clients the user will have the access to. Contact the administrator and ask him to change the password. Check the groups which the user belongs to. He/she might have inherited some new permissions from these groups. Check the Spam folder. Management Tool Error Messages The following table provides the list of error messages that you may see while working in the Management Tool and their causes and possible solutions. Message If you get the following message when trying to connect to the Management Tool: Server is unavailable. Please contact administrator. Cause/Solution The program encountered an unexpected error while trying to perform an action. Please refresh the Management Tool. Please make sure that the Server is running. 168

169 Please restart the Server and try again. If the problem comes up again, please contact the support. If you get the following message when trying to connect to the Management Tool: Wrong password or username. Please make sure that your login and the password are correct. If you are logging in as a Windows user, don t forget to write <domain name>\<login>. Monitor Monitor Related Issues Issue Cause/Solution I have successfully logged into the System Monitor but I cannot see any captured data from the Client. An alert event does not trigger an alert notification and is not displayed as alert in the Monitor. Please check the section Possible Problems with Receiving Data from Clients. Contact the administrator and check if you have the Viewing monitoring results permission for the Client. Please check that the defined alert parameters are correct on the Alert Rules tab on the Edit alert page of the Management Tool (e.g., Process name may be defined instead of Window title). To do this, open the Alert Management page of Management Tool, click Edit alert for the required alert and select the Alert Rules tab. The alert might be disabled. Please make sure the alert is enabled on the Alert properties tab in the Management Tool. I don`t receive alert notifications about all the events that correspond to notification settings. I have connected to another Server and started the Monitor, but alert Please check the Minimal interval between notifications sent for the same alert event parameter. If less time than defined in the settings has passed since the moment when the last notification for the same alert event had been received, you will not receive the notification. Restart the Monitor Tray. 169

170 notifications are being sent from the old Server. Some screen captures are blank. If a user types something continuously, stops typing, and then switches the window during the 3 seconds period, the keystrokes will be attached to a blank screen capture. If a user accesses the Client computer via the Remote Desktop Protocol (RDP) and minimizes the Remote Desktop Connection window, a blank screen capture is created. Some screen captures look like they consist of two parts. There are two monitors on the Client computer and you see the screen captures from both of them. The Keystrokes field is empty, although the text was entered on the Client computer. Please check that you have enabled the keystroke logging in the Client configuration. The keystrokes are logged only after the user presses Enter or switches to another window. So they might be attached to another screen capture. Some/all keystrokes are displayed incorrectly. The screen captures are sent more frequently than I defined. Screen capture image is blurry. The screen capture image is black and white. The screen capture time does not correspond to time on my computer. The symbols entered on the Client computer are not supported by the Monitor computer. Please make sure your system supports the language used on the Client computer. If in the Client configuration you have enabled options other than Capture screen periodically, the screen captures may be created more frequently depending on the user activity. Check the Client configuration. The Client computer may have smooth interface animation the screen capture may have been taken when the animation was in progress. The Client is configured to capture screen in greyscale images. Please check the Client configuration in the Management Tool. The screen capture time corresponds to the time displayed on the Client computer. 170

171 The screen capture time does not correspond to the time that should be displayed on Client computer. Please check that the Client computer time settings have not been changed. I cannot activate live view, although the Client is online. The session status may not be updated. To update the session status, click the search button or restart the Monitor. If the Live button is disabled, it means that the list of screen captures for the selected session has not been loaded yet. Wait for the list to load all screen captures. I cannot start the Monitor tray service. To start the Monitor tray service, you must first log in to the Monitor using valid login credentials. Monitor Error Messages The following table provides the list of error messages that you may see while working in the Monitor and their causes and possible solutions. Message Cause/Solution If you get the following message during login to the Monitor: Cannot connect to the Server or Server is not licensed. The Server computer may be offline. Make sure the Server computer is online. To check that the Server computer is online, enter the following command in the Windows command line: ping <name/ip address of the computer> If you do not receive any response, the access might be blocked by the remote computer Firewall. The Server may be stopped. Make sure the Server is started on the Server computer. Make sure the Server is licensed. There must be at least one activated serial key (not a trial serial key) on the Server. If you get the following message during login to the Monitor: Login or Password is wrong, although you entered valid credentials. Make sure your login and password are correct. If you log in under a domain user, enter domain/login. If the entered credentials are correct, contact the administrator and ask if the user with such name and password exists in the system. 171

172 If you get the following message during report generation: The report cannot be generated. MS Excel is not installed. Please install Excel and try again. If you get the following message during report generation: Error occurred while saving the document. You need to install the Microsoft Office Excel to be able to generate a report. The name of the report is too long. Make sure the full file path does not exceed 218 characters. If you get the following message during report generation: Error occurred while retrieving data for report, please try again. The Monitor has lost the connection to the Sever/database. Please make sure that the Server service is running on the Server computer and that the Server computer and computer on which the database is installed are online and accessible. To check that the computer is accessible, enter the following command in the Windows command line: ping <name of the Server computer/computer on which the database is installed> If you get the following message during report generation: Error occurred while generating report. If you get the following message during report generation/export of a video: Impossible to proceed. Please check the name of file. If you get the following message while exporting a video: There is not enough free space. Clear your disk space or change video file location to another one and try again. If you get the following message while exporting a video: Cannot export video. Choose another codec and try again. If you get the following message while exporting a video: An error has occurred while exporting video. Some data was deleted from player cache. The problem encountered an unexpected error while generating report. Try closing the report generation window and generating a report again or restart the Monitor. Please make sure the file path does not contain one or more of the following illegal characters: /? < > \ : * ^ There is not enough space on the disk to which you are trying to save a video. Please free some space on the disk or choose a location for saving on another disk. The codec you have selected for exporting a video is not supported. Please select another codec. The data from the Monitor temporary cache folder (C:\Documents and Settings\<user name>\local Settings\Temp\CensorNet\Desktop Surveillance\Cache) was deleted. Please select the 172

173 Perform the same search and try again. If you get one of the following messages: An error has occurred during exporting video. Connection with Server is lost. Error occurred while retrieving data for report, please check the Server connection. If you get the following message while saving the search: Entered name already exists or is too long. Enter another name for saved search. If you get the following message while adding search criteria: There are too many criteria. If you get the following message while exporting a video: Cannot get properties dialog from selected codec. If you get the following message while exporting a video: Entered path is incorrect or you do not have write permissions. If you get the following message while exporting a video: An error has occurred while enumerating codecs. required session to reload its cache data and try exporting a video again. The Monitor has lost the connection to the Sever. Please make sure that the Server is running on the Server computer and that the Server computer is online and accessible. To check that the Server computer is accessible, enter the following command in the Windows command line: ping <name of the Server computer> The name you have defined for the search is too long (more than 50 characters) or the saved search with such name already exists. Please define a shorter name or define another name. The limit for the number of search criteria has been reached. There can be no more than 10 search criteria. There may be problems with exporting a video using the selected codec. Try exporting a video again or try another codec. If the problem comes up again, please, contact the support. The folder to which you try to export a video may be write-protected. Try exporting a video to another location. If the problem comes up again, please, contact the support. The program encountered an unexpected error getting the list of codecs. Please try exporting a video again or try reinstalling the codecs on your computer. If the problem comes up again, please, contact the support. Client Checking that the Client Is Installed If the Client is successfully installed, it will appear on the Clients page of the Management Tool in the Data View pane. If there is no Client in the Management Tool, you have to check whether the Client has been installed. 173

174 You can check if the Client is installed on the investigated computer in one of the following ways: Two DesktopSurveillanceService.exe processes are started on computers with x86 architecture; two DesktopSurveillanceService.exe processes and one DesktopSurveillanceServicex86.exe process are started on computers with x64 architecture. The DesktopSurveillanceService and DesktopSurveillanceController services are started. There is a <system disk>:\program Files\CensorNet\Desktop Surveillance\Client\ folder with executable files. The HKEY_LOCAL_MACHINE\SOFTWARE\CensorNet\Desktop Surveillance\Client key has the following values: Clients Installation/Uninstallation Issues and Error Messages The common reasons of issues with remote installation or uninstallation of Clients are the inadequate network configuration or system settings. If you are sure that a user has administrative rights on the Client computer, please check whether all of the conditions for successful installation are met. Remote Installation Error Messages 174

175 During remote Client installation you can get the following error messages: The user doesn t have enough permission on the remote host. The network name cannot be found. Client machine must be rebooted before agent installation. The host is unavailable now or turned off. Try again later. Solving Remote Installation Issues If you receive the following error message during the remote Client installation: The User doesn t have enough permission on the remote host, as a rule, such issue may be caused by the following reasons: There is no access to network shares. DNS service is unavailable. UAC is enabled (Windows 7/8/Vista). Errors in Active Directory. Issues with the Service Principle Name for the domain. Two computers have the same computer name. Issue: There is No Access to Network Shares For successful remote installation, Desktop Surveillance needs to access the administrative shares on the target computers. At first, please check that you have access to administrative shares and if there is no access, enable it. How to Check: To check the administrative shares availability, do the following: 1. Open Windows Explorer. 2. In the address bar type \\<target_computer_ip/name>\admin$ and press Enter. 175

176 3. When the Enter Network Password window opens, enter administrator credentials and click OK. 4. If the login credentials are accepted, the system folder opens (by default, C:\Windows). If you get an error after performing step 2, try the following: Open the Command Prompt (cmd.exe). Enter and execute the ping <target_computer_name or IP> command. Check the following: 1. If you do not get ping replies, network may be down. Check the network connection and try again. 2. If the network is up, but you don't get the ping reply, check the firewall on the remote computer. Disable the firewall on the target remote computer. If you are receiving ping replies, but the administrative share is still unavailable, check that the Sharing Wizard or the Simple file sharing are disabled. If you are receiving ping replies and the sharing options are good, but you still cannot access the administrative shares, check that the Server system service is running on the remote computer. If you get a login error after performing step 3, try the following: Make sure that the credentials you enter are correct. You have to enter the credentials of a domain administrator or a local administrator account on the remote computer. Verify that the account password is not empty. Accounts with empty passwords cannot be used for remote connection. Try typing the username as <domain_name>\<username> if the remote computer is in a domain, or <computer_name>\<username> if the PC belongs to a workgroup. 176