User Activity Monitor : Viewing User Activity : Session Viewer : Keystroke recording viewer
  
Keystroke recording viewer
A table in the lower part of the details pane displays records of the user’s keystrokes, with the following information on each record:
Date/Time - The date and time the user started typing.
Window Title - The title of the application window into which the user typed.
Keyboard Input - The characters the user typed and, optionally, the names of the pressed non-character keys.
Process Name - The name and path of the executable file of the application into which the user typed. The process identifier (PID) is displayed in parentheses after the file name.
By default, Keyboard Input displays only the characters the user typed. Non-character keys the user pressed (such as Shift, Alt, Enter, Right, Left, etc.) are skipped. To view all recorded keystrokes, select the Show specials check box. With this check box selected, the viewer displays both the typed characters and the names of non-character keys the user pressed, with the names of non-character keys enclosed in square brackets (for example, [Shift]serial number).
If the recording was performed with Log passwords enabled, Keyboard Input also displays in red the passwords the user entered; otherwise, it displays asterisks in place of passwords.
 
Note: When entered in the Windows Security dialog box, the user name and password are logged together. Therefore, in this case, the user name is also highlighted in red or replaced with asterisks in Keyboard Input, depending upon whether Log passwords was enabled during recording.
The viewer provides a shortcut menu with the following commands on keystroke records:
Copy (Ctrl+C) - Serves to copy the selected text of the recording to the Clipboard.
Select All (Ctrl+A) - Serves to select the entire text of the keystroke recording.
Print (Ctrl+P) - Serves to print the keystroke recording on the printer.