Examples of user activity monitoring rules
The following examples show how user activity monitor works in some typical usage scenarios. They help to better understand the behavior of some triggering criteria, their role in the recording start conditions and interrelation with other monitoring settings, and the conditions that cause recording to stop.
Example 1: Recording starts immediately after the user logs in
To record user activity, it is required that the user be logged in and authenticated. Therefore, each user activity monitoring rule always contains a condition to start recording upon user login. Thus, if a rule is specified without any additional triggering criteria, the DeviceLock Service will start recording immediately after the user successfully logs on and authenticates to the domain or to the local PC.
To record user activity for a specific time after the user logs in, configure a rule with the following settings:
•User logged in - Recording start condition, specified by default.
•Force stop capture in <number> seconds - Check box selected.
•Do not run this rule again until its condition changes - Check box selected.
Thus, to record for at most an hour, a value of 3600 seconds must be specified:
Force stop capture in 3600 seconds
With this rule, recording starts as soon as the user logs in, and stops either after an hour or earlier in case of user logout in less than an hour. The next time recording starts after the user logs out and then logs back in.
Example 2: Application usage recording starts upon VPN connection
The DeviceLock Service can be configured to record the user’s activity in a situation where a certain application is running and a virtual private network (VPN) connection is established. The respective recording start condition looks as follows:
Process “<name>” exists AND VPN connection exists
Thus, to record when using Excel, the executable file’s name excel.exe must be specified:
Process “*\excel.exe” exists AND VPN connection exists
Because of AND logic, recording does not start when using Excel without VPN. However, once VPN is connected, DeviceLock will be recording the user activity as long as Excel is running. Recording will stop upon closing Excel or disconnecting VPN.
Example 3: Time-limited recording starts upon Wi-Fi connection
Another example is to configure the DeviceLock Service to record the user’s activity for a certain time period after establishing a wireless network connection. The rule settings in this case are as follows:
•Wireless connection exists - Recording start condition.
•Force stop capture in <number> seconds - Check box selected.
•Do not run this rule again until its condition changes - Check box selected.
Thus, to record for at most 30 minutes after establishing a wireless network connection, a value of 1800 seconds must be specified:
Force stop capture in 1800 seconds
Such a rule starts recording once a wireless network has connected. In this example, recording lasts no more than 30 minutes and stops either after 30 minutes or earlier, in case of a disconnection from the wireless network in less than 30 minutes. Recording will start again only after disconnecting from and then re-connecting to a wireless network.
Example 4: Recording starts upon running a particular application
Let us consider a rule that would start recording, depending on whether a particular application is running, that is, recoding starts if the respective process name or window caption is present in the system. Here is the recording start condition for such a rule:
•Process “<name>” exists - Application identified by process name.
•Window “<title>” exists - Application identified by window title.
If the DeviceLock Service is already running when the application is started, it will notice that the specified process or window has appeared on the system, and will start recording. However, certain processes may be up and running before the start of the DeviceLock Service, for instance, when the DeviceLock Service starts on a system that has already been running for some time. In this case, the DeviceLock Service searches the system for the processes and windows referenced in its user activity monitor rules, and starts recording as those rules require. Hence, the rules respond to the presence of a process or window in the system rather than to the fact of its appearance.
Example 5: Recording starts on user inactivity
This example covers a rule that causes DeviceLock to start recording if the computer is not screen-locked and it is not being used for a certain time period. The rule triggers when the user does not press keys on the keyboard, does not move the mouse, nor clicks with it for some time. In contrast to the option
Pause while inactive, this rule starts rather than suspends recording in the absence of user activity. The recording start condition looks as follows:
Computer is idle for <number> seconds
Thus, for recording to start after 5 minutes of user inactivity, a value of 300 seconds must be specified:
Computer is idle for 300 seconds
If such a rule is in effect, recording starts when, for the specified time on the computer, there are no keystrokes or mouse clicks/moves, while the computer is not screen-locked. Recording stops once any activity using the keyboard or mouse has occurred on that computer.