The Safeguard for Privileged Passwords Desktop Player is installed with the Windows desktop client. When the player is launched from the desktop client, the recording is being streamed from the Safeguard appliance. It only exists on the disk for the lifetime of the player session. That is, when you shut down the player, the recording file is removed from the cache.
When you launch the Safeguard for Privileged Passwords Desktop Player, the main view displays, which consists of the following tabbed pages:
The information tab displays the following details for the session recording.
|Session recording location||
Displays the path of where the recording is currently stored.
Click the thumbnail in the right corner of the screen to play back the recording.
The Safeguard for Privileged Passwords Desktop Player checks the upstream and downstream traffic from the recording and validates the digital signature and timestamp. The indicators across the top of the screen show the results of this validation process, where all indicators should display a green check mark.
If the Signature or Timestamp indicators are red Xs, this indicates that the corresponding certificate has not been validated.
Displays details about the recording, such as:
|User||Displays the name of the user that authenticated to the remote machine..|
|Connections||Displays connection information, including the address and port of client computer and the remote machine.|
An SSH session recording will contain a single channel. Valid channels for an SSH session recording are:
An RDP session may contain multiple channels. Valid channels for an RDP session recording are:
Click the Play button next to the channel to play back the session recording.
Clicking the expansion button next to a channel displays a list of key details.
The warning tab displays any warnings encountered when opening and processing the recording.
Use the toolbar buttons located at the top of the main view as described below.
Displays the previous view. For example, if you clicked play and are in the video view, clicking this button returns you to the recording information view.
Plays back the selected sessions recording.
Exports the sessions recording file as a video file (WEBM format).
Allows you to import keys and certificates, access the One Identity support web site for help, and view version information about the player.
Once the play back window opens you can use the controls at the bottom of the screen or keyboard shortcuts to navigate through the recording.
Use the controls at the bottom of the screen to navigate through the sessions recording.
Shows you where you are within the recording. The timeline can also show indicators for user events that occurred during a recorded session. Clicking an indicator on the timeline takes you to the relevant user event in the recording.
For more information on showing or hiding the user event indicators on the timeline, see Configure seeker indicators below.
|Allows you to increase or decrease the replay speed.|
|Allows you to jump back to the previous user event in the recording.|
Play allows you to play the recording.
Pause allows you pause the recording.
Allows you to jump forward to the next user event in the recording.
Allows you to display subtitles for the video that list user events as they occurred within the recorded session.
User events that may appear as subtitles include windows titles, executed commands, mouse activity, and keystrokes.
Configure seeker indicators
Allows you to configure the visibility of user event indicators on the timeline. To show a user event indicator move the toggle to the right; to hide a user event indicator move the toggle to the left.
Allows you to view the recording in a smaller or larger window. Clear this check box to play the video using the original resolution.
When you are watching a "live" session, the playback navigation controls are replaced with different follow mode navigation controls.
|NOTE: Follow mode is only available to users with Security Policy administrator permissions.|
|Terminate||Allows you to end the current session you are following.|
|Live||Indicates you are following a "live" session.|
You can also use the following shortcut keys to navigate through the recording.
|Ctrl+Z||Enable video scaling|
|f||Toggle full screen replay|
|[||Decrease replay speed|
|]||Increase replay speed|
|=||Reset replay speed|
|Shift + Left Arrow||Jump backwards - short|
|Alt + Left Arrow||Jump backwards - medium|
|Ctrl + Left Arrow||Jump backwards - long|
|Shift + Right Arrow||Jump forward - short|
|Alt + Right Arrow||Jump forward - medium|
|Ctrl + Right Arrow||Jump forward - long|
Use the Export Video button at the top of the Safeguard Desktop Player to export the sessions recording file as a video file (WEBM format). This WEBM file can then be played back using any standard video player, such as the one available with Firefox or Google Chrome.
To export a video
In the Safeguard for Privileged Passwords Desktop Player, click Export Video.
The Export screen appears, displaying the name of the video file and the size of the file.
Click the browse button () in the lower right corner of the screen to specify the location where the file is to be stored.
The specified location appears in the Export to field.
Click the Export button.
An Export Successful message appears.
Expanding a channel in the Channels pane of the Safeguard for Privileged Passwords Desktop Player displays additional details about the recording. The keys displayed depends on the type of channel selected. The keys marked with an asterisk (*) may provide you some additional insight into the recording; most of the other keys are internal values.
|auth_method||Authentication method used.|
|bpp||Color depth (bits-per-pixel) of the remote machine.|
|channel_id||Internal identifier assigned to the channel being recorded.|
|channel_name||Internal name assigned to the channel being recorded.|
|channel_policy||Internal name assigned to the channel policy being used.|
|channel_type||Type of channel: SSH or RDP|
|client_address*||Address of the client computer.|
|client_address.ip||IP address of the client computer.|
|client_address.port||Port used by the client computer.|
|client_id||Internal identifier assigned to the client computer.|
|client_x509_subject||Client certificate subject.|
|connection||Internal connection policy being used.|
|connection_id||Internal connection identifier assigned to the recording.|
|data_received||Data received flag: True|
|data_sent||Data sent flag: True|
|dst_ip||IP address of the session recording module.|
|duration*||Duration of the recording.|
|duration_raw||Raw duration of the recording (should be the same as the duration).|
|exit_status||Exit status of the program run on the remote server.|
|height_rows*||Number of rows shown in the SSH terminal.|
|initiator||Who initiated the connection: Client|
|is_processable||Indicates if the session can be processed: True|
|local_ip||IP address of the sessions module.|
|protocol*||Protocol used: SSH or RDP|
|remote_username*||Name of the user name that log into the remote machine.|
|server_address*||Address and port of the remote machine.|
|server_address.ip||IP address of the remote machine.|
|server_address.port||Port used to connect to the remote machine.|
|server_id||Internal identifier assigned to the remote machine.|
|server_ip||IP address of the remote machine.|
|session_end||Time (in milliseconds) when the session ended.|
|session_id||Internal session ID assigned to the session.|
|session_start||Time (in milliseconds) when the session started.|
|Signature||Validity of the Session Recording Signing certificate.|
|source||Source protocol: SSH or RDP|
|stream_type||Internal type assigned to the recording stream.|
|term||Type of SSH terminal.|
|Timestamp||Validity of the Timestamping Authority certificate.|
|username||Name of the user that authenticated to the remote machine.|
|width_cols||Width (in columns) of the original SSH session screen.|
|width_pix*||Width (in pixels) of the original SSH session screen.|
|width*||Screen width of the RDP session.|