Session Recording
Configuration
This module covers the full session recording pipeline for the Delinea Secret Server and Delinea Platform. You will learn to configure recording storage, enable keystroke logging, set up live monitoring, manage idle-session termination, and review recordings through the audit viewer for compliance and forensic investigation.
What You'll Learn
Session recording is a critical component of privileged access security. This module walks through every configuration touchpoint — from the distributed proxy architecture to the final audit playback.
Session Recording Pipeline Architecture
Before configuring session recording, it's essential to understand how session data flows through the Delinea infrastructure. The recording pipeline consists of several coordinated components that capture, process, and store session content.
Pipeline Components
The session recording pipeline intercepts privileged sessions at the protocol proxy layer, encodes the session stream, and delivers it to persistent storage — all without modifying the end-user experience.
Workstation
Proxy (SS)
Engine
Compressor
Storage
Viewer
Key Components Explained
Supported Protocols
| Protocol | Recording Mode | Keystroke Support | Live View |
|---|---|---|---|
| RDP | Video + Metadata | Yes | Yes |
| SSH | Text Stream + Timing | Yes | Yes |
| HTTPS (Web) | HTTP Request Log | Partial | Limited |
| Telnet | Text Stream | Yes | Yes |
| VNC | Video | No | Yes |
Configuring Recording Storage
Secret Server supports two primary storage destinations for session recordings: local on-premise file storage, and cloud-based storage through the Delinea Platform. Each option has distinct configuration paths, capacity considerations, and lifecycle management capabilities.
Storage Architecture Options
Configuring Local Storage
\\fileserver\recordings) or a local directory path. The Secret Server service account must have read/write access to this path.Interactive Config Panel — Local Storage
Cloud Storage Configuration
When selecting Delinea Cloud as the storage destination, Secret Server connects to the Delinea Platform's blob storage endpoint. The configuration differs in that you provide a Platform Tenant URL and API credentials rather than a file path.
Storage Destination: Delinea Cloud
Platform Tenant URL: https://your-tenant.delinea.app
Client ID: <Service Account Client ID>
Client Secret: <Service Account Secret>
Storage Bucket: session-recordings-prod
Retention (Days): 365
# Encryption is managed by Delinea Platform — always on
Enabling Keystroke Logging
Keystroke logging captures every key pressed during a session and stores it as indexed, searchable metadata alongside the session recording. This dramatically enhances audit capability — reviewers can search for specific commands without scrubbing through video.
How Keystroke Capture Works
For SSH sessions, keystrokes are captured from the protocol stream directly — no agent is required on the target. For RDP sessions, Secret Server intercepts keyboard input at the proxy layer before forwarding to the remote desktop host. Captured keystrokes are timestamped and stored separately from the video stream.
Enabling Keystroke Logging — Configuration
Keystroke Masking
The Mask Credential Entry toggle automatically detects when a user is typing in a password field (identified by the RDP input context or SSH echo-suppression state) and replaces those keystrokes with asterisks in the log. This prevents the logging engine from capturing plaintext passwords while maintaining audit coverage for commands.
| Setting | Effect | Recommendation |
|---|---|---|
| Keystroke Logging ON | All keystrokes captured and timestamped | Enable |
| Mask Credential Entry | Password field input replaced with **** | Enable |
| Keystroke Indexing | Keystrokes become full-text searchable | Enable |
| Activity Baseline Alerting | ML-based anomaly detection on keystroke velocity | Optional |
| Export Keystroke Log | Allow CSV export of keystroke data | Restricted Role Only |
rm -rf, net user, or reg delete to instantly surface all sessions containing those commands — across thousands of recordings.
Live Session Monitoring
Live session monitoring allows authorized supervisors to view active privileged sessions in real time. This enables supervisory review of high-risk access, immediate intervention when suspicious activity is detected, and real-time compliance oversight without disrupting the active session.
Configuring Live Monitoring Access
Live session viewing is controlled through role-based access. Only users assigned the Administer Session Monitoring role permission can view live sessions. This is separate from the role required to view recorded sessions.
Live Monitoring Configuration Panel
Accessing the Live Session Viewer
Supervisors with the correct role access the live session list by navigating to Admin › Active Sessions. This dashboard shows all currently active sessions with user, target, protocol, duration, and recording status columns. Clicking a session row opens the live viewer in a new browser pane.
Idle-Session Termination
Idle-session termination automatically disconnects privileged sessions that have been inactive for a defined period. This prevents open privileged sessions from becoming attack vectors if an administrator steps away from their workstation without locking it.
Why Idle Termination Matters
Idle Termination Configuration
Per-Secret Timeout Override
The global idle timeout can be overridden at the individual secret level for high-sensitivity targets. For example, you may configure a global 15-minute timeout but allow production database secrets to use a 5-minute timeout for tighter control.
| Secret Type Example | Recommended Timeout | Rationale |
|---|---|---|
| Domain Admin | 10 min | Highest-risk credential, strict timeout enforced |
| Production DB Server | 5 min | Data sensitivity demands minimal idle window |
| Dev/Test Server | 30 min | Lower risk; longer timeout reduces friction |
| Network Device (SSH) | 15 min | Standard timeout for infrastructure access |
| Cloud Console Access | 10 min | Cloud blast radius risk justifies tighter control |
Audit Viewer & Session Review
The Secret Server Audit Viewer is the primary interface for searching, filtering, replaying, and exporting recorded sessions. It serves compliance auditors, incident responders, and security operations teams investigating privileged access events.
Accessing the Audit Viewer
Navigate to Admin › Session Recording › Recorded Sessions. The audit viewer is also accessible from any secret's Audit tab, where it pre-filters to sessions launched from that specific secret. Viewing recorded sessions requires the View Session Recording role permission.
Search & Filter Capabilities
Replaying a Recorded Session
Audit Viewer Filter Reference
| Filter Field | Values / Format | Use Case |
|---|---|---|
| User | Username or wildcard | Investigate specific admin's sessions |
| Target Machine | Hostname or IP | All sessions to a compromised server |
| Secret Name | Exact match or contains | Sessions launched from a specific credential |
| Date Range | Start/End datetime | Scope investigation to incident window |
| Protocol | RDP / SSH / Telnet / Web | Filter by access type |
| Keystroke Contains | Free text / regex | Find sessions with specific commands |
| Duration (min) | Greater than / less than | Find unusually long sessions |
| Idle Terminated | Yes / No | Identify sessions that auto-disconnected |
| Supervisor Viewed | Yes / No | Track sessions reviewed by management |
| Legal Hold | Yes / No / Set | Manage compliance retention exceptions |
whoami /all, net localgroup, mimikatz). (4) Export flagged sessions and set Legal Hold before your retention policy purges them.
Knowledge Check
Test your understanding of session recording configuration in Secret Server. Select the best answer for each question. Review any missed questions before proceeding to the module summary.
Module Summary & Deployment Checklist
Congratulations — you've completed the Session Recording Configuration module. Use the checklist below to verify your deployment is fully configured before signing off. Click each item to mark it complete.
Deployment Readiness Checklist
Quick Reference Summary
| Feature | Navigation Path | Key Toggle / Setting |
|---|---|---|
| Enable Recording | Admin › Configuration › Session Recording | Enable Session Recording |
| Local Storage | Admin › Configuration › Session Recording | Storage Location = Local + UNC Path |
| Cloud Storage | Admin › Configuration › Session Recording | Storage Location = Delinea Cloud + API creds |
| Keystroke Logging | Admin › Configuration › Session Recording › Keystrokes | Enable Keystroke Logging + Indexing |
| Live Monitoring | Admin › Configuration › Session Recording › Live Monitoring | Enable Live Session Viewing |
| Idle Termination | Admin › Configuration › Session Recording › Idle Settings | Enable Idle Session Termination + Timeout (min) |
| Audit Viewer | Admin › Session Recording › Recorded Sessions | Search + Playback + Legal Hold + Export |