The User Filtering Parameter
User filtering allows you to reduce the amount of information received from the Windows Client by defining Client computer users whose data will be skipped during monitoring.
User filtering affects both primary and secondary users.
User filtering can be performed in one of the following three states by selecting the option required in the Filter State drop-down list (on the Editing Client / Editing Client Group page, on the User Filtering tab, in the User Filtering section):
• Disabled: The activity of all users is monitored.
• Monitor only the activity of selected users: Only the activity of specified users is monitored, while the activity of all other users is skipped.
• Monitor the activity of all users except: The activity of all users except specified ones is monitored, allowing the activity of specific users (e.g. the administrator) to be skipped.
You can define user names for filtering by entering them manually, or by clicking the Add Users button and then selecting the required users from the list.
When you enter user names manually, they must be entered as <domain or computer name>\<user name>. To specify all users of a domain group, you can enter the domain group manually in the format $<domain name>\<domain user group name> without having to enter each user name separately.
The values entered must be separated by commas, semicolons, or new line characters. You can also use an asterisk as a domain, computer, user or domain group mask (e.g. *\admin*;$*\Administrator*).
When you click the Add Users button, a pop-up window opens. Only those users whose activities have already been monitored are listed in the pop-up window. Select the user names to be added, and then click Add.
NOTE: If you select a user with secondary user authentication in the pop-up window (e.g. “WORK\janet (jan)”), you need to delete the parentheses in the field below, and instead add a semicolon before it (i.e. “WORK\janet;jan”).
Examples of parameters:
.ini File Parameter | Parameter Defined in the Management Tool |
Monitor all user activity without applying any filters. | |
[FilterParameters] UserFilterState=disable UserFilterNames= | On the User Filtering tab, in the User Filtering section, in the Filter State drop-down list, make sure that Disabled is selected. |
Monitor only the activity of the user “janet” and the user “joe”, in the “work” domain. | |
[FilterParameters] UserFilterState=include UserFilterNames=WORK\janet;WORK\joe | On the User Filtering tab, in the User Filtering section, do the following: 1. In the Filter State drop-down list, select Monitor only the activity of selected users. 2. In the field below it, enter “work\janet;work\joe” manually, or select the users from the list by clicking the Add Users button. |
Monitor the activity of all users except users with the login “administrator” (both local and domain users). | |
[FilterParameters] UserFilterState=exclude UserFilterNames=*\administrator | On the User Filtering tab, in the User Filtering section, do the following: 1. In the Filter State drop-down list, select Monitor activity of all users except. 2. In the field below it, enter “*\administrator” using an asterisk as a name/domain mask. |
Monitor only the activity of the Ekran System user “janet” with secondary user authentication. | |
[FilterParameters] UserFilterState=include UserFilterNames=WORK\janet;janet | On the User Filtering tab, in the User Filtering section, do the following: 1. In the Filter State drop-down list, select Monitor only the activity of selected users. 2. In the field below it, enter “work\janet;janet” manually, or select the user from the list by clicking the Add Users button. |
Monitor only the activity of all users in the “work” domain user group of the “company” domain. | |
[FilterParameters] UserFilterState=include UserFilterNames=$company\work | On the User Filtering tab, in the User Filtering section, do the following: 1. In the Filter State drop-down list, select Monitor only the activity of selected users. 2. In the field below it, enter “$company\work” manually. |