User Manual

This full user manual provides detailed information on all aspects of Ekran System, including deploying, configuring, maintaining and using the whole system with all of its component parts.

Table of Contents

• Introduction
• System Requirements
  • Software Requirements
    • Application Server Requirements
    • Database Requirements
    • Management Tool Requirements
  • Hardware Requirements
    • Small Deployments (Up to 200 Concurrent Sessions)
    • Medium Deployments (Up to 1,000 Concurrent Sessions)
    • Large Deployments (Up to 10,000 Concurrent Sessions)
  • Client Requirements
    • Client as a Terminal Server Requirements
    • Windows Client Requirements
    • A Linux Client as a Terminal Server Requirements
    • Linux Client Requirements (Monitoring of the GUI for X Window System)
    • macOS Client Requirements
    • Client Performance Numbers
• System Overview
  • System Structure and Architecture
    • Large-Scale Deployments
      • High Availability
        • Disaster Recovery
        • Load Balancing
      • Multi-Tenant Mode
    • Client Types Supported
      • VDI Monitoring
• Getting Started & System Deployment
  • Getting Started (Checklist)
  • System Deployment
    • Installation (Checklist)
    • Quick Start Deployment Guide
  • Using the System (Checklist)
• Updating the System (Checklist & Best Practices)
• The Application Server and the Database
  • Comparison of Database Types
  • Comparison of Standard and High Availability Modes
  • Installing the Remote PostgreSQL Database Server and Configuring Remote Access
  • Installing/Uninstalling/Updating the Application Server
    • Installing the Application Server
    • Backing Up the Master Certificate
    • Deleting the Master Certificate
    • Importing the Master Certificate
    • Reissuing the Ekran System Master Certificate
    • Installing the Application Server in the Cloud
    • Adding the Application Server Executable to Windows Firewall
    • Using an External/Cloud-Based Application Server
    • Updating the Application Server
    • Uninstalling the Application Server
    • Changing the Application Server Port for Client Connection
    • Running the EkranServer Service under a User Account
    • Adding Permissions for a Non-Admin User to Start EkranServer
    • Enabling SWIFT Username Monitoring
    • Enabling the Displaying of the Warning and Consent Banner
  • The Server Tray Application
  • Database Management
    • Cleanup Parameters
    • One-Time Cleanup
      • One-Time Cleanup while Editing a Client
      • One-Time Cleanup while Editing a Client Group
    • Scheduled Cleanup
      • Scheduling a Cleanup while Editing a Client
      • Scheduling a Cleanup while Editing a Client Group
    • Editing the Database Parameters
    • Cleaning Up the Sessions of Deleted Clients
    • Shrinking the MS SQL Database Transaction Log
    • Autovacuuming the PostgreSQL Database
    • Deleting Clients
    • Moving the Server Database
      • Moving the MS SQL Database
        • Moving the MS SQL Database on the Same Computer
        • Moving the MS SQL Database to Another Computer
        • Moving the MS SQL Database Signed with a Certificate to Another Computer
          • Exporting the Trusted Certificate
      • Moving the PostgreSQL Database
        • Moving the PostgreSQL Database on the Same Computer
        • Moving the PostgreSQL Database to Another Computer?
    • Validating Monitoring Data
      • Validating Monitoring Data Using Hash Codes
      • Signing Monitoring Data with a Certificate
        • Step 1. Importing a Trusted Certificate
        • Step 2. Enabling the of Signing of Monitoring Data with a Certificate
    • Deleting the PostgreSQL Database
    • Isolating the Database from Clients
• The Management Tool
  • Management Tool Installation Prerequisites (Checklist)
    • Turning on Internet Information Services (IIS)
      • Turning on IIS for Windows 8.1 and Windows 7
      • Turning on IIS for Windows Server 2012
      • Automating IIS Installation on Windows Server 2019 Core
    • Installing .NET Framework
    • Configuring Internet Information Services (IIS)
    • Using a Self-Signed Certificate
      • Creating the Self-Signed Certificate
      • Exporting a Self-Signed Certificate
      • Importing a Trusted Certificate
      • Adding the Self-Signed Certificate to Trusted Root Certification Authorities
      • Setting Up an HTTPS Binding for the Default Website
      • Using a Self-Signed Certificate on Windows Server 2019 Core
  • Installing/Uninstalling/Updating the Management Tool
    • Installing the Management Tool
    • Configuring a Computer for Remote Access
    • Updating the Management Tool
    • Uninstalling the Management Tool
  • Opening the Management Tool
  • The Management Tool Interface
  • Changing a User's Own Password while Logged In
  • Management Tool Access Using Smart Cards
    • Prerequisites for Using Smart Cards for Access
    • The Client Certificate Mapping Authentication Role
      • Setting Up the Client Certificate Mapping Authentication Role for Windows 10/8/7
      • Setting Up the Client Certificate Mapping Authentication Role for Windows Server 2012/2016
    • Configuring Client Certificate Mapping Authentication
    • Opening the Management Tool Using Smart Cards
• Multi-Tenant Mode
  • User Types when Deployed in Multi-Tenant Mode
    • The Admin User of the Built-In Default Tenant (the Technician)
    • The Tenant Admin User
    • Tenant Users
  • Enabling Multi-Tenant Mode
  • Tenant Management
    • Viewing Tenants
    • Adding Tenants
    • Editing Tenants
    • Decreasing the Number of Licenses Granted to Tenants
    • Resending the Tenant Admin a Password by Email
    • Changing the Domain Tenant Admin
    • Deleting Tenants
    • Switching to Another Tenant Account
  • Granting the Technician Access to a Non-Default Tenant
• Application Server Configuration
  • Settings Available for the Admin User of the Built-in Default Tenant (the Technician) and Other Users in Single-Tenant Mode
    • Defining Email Sending Settings
    • Defining System Settings
    • Defining Customization Settings
    • Defining SIEM Integration
    • Defining Ticketing System Integration Settings
    • Defining LDAP Targets
      • Automatic LDAP Targets
      • Adding a Single Domain as an LDAP Target Manually
      • Adding an AD Global Catalog as an LDAP Target Manually
      • Editing an LDAP Target
      • Deleting an LDAP Target
    • Defining the Date & Time Format
    • Defining Export Storage Settings
    • Defining Database Management Settings
  • Settings Available for the Tenant Admin in Multi-Tenant Mode
    • Defining System Settings
    • Defining Customization Settings
    • Defining the Date & Time Format
    • Defining Database Management Settings
• Licensing
  • General Licensing Information
  • Granting Licenses by the Administrator of the Built-In Default Tenant (the Technician)
    • Serial Keys
    • The Update & Support Period
    • Viewing the License State
    • Activating Serial Keys Online
    • Activating Serial Keys Offline
    • Configuring a Web Proxy Server for Activation of Serial Keys
    • Deactivating Serial Keys
    • Viewing the Licenses Granted to Tenants (in Multi-Tenant Mode)
  • License Management
    • Viewing License Information (by the Tenant Admin)
    • Assigning/Unassigning Licenses to/from Clients Manually
    • Reassigning Licenses between Clients
• User and User Group Management
  • Viewing Users and User Groups
  • User Management
    • Adding Users
    • Editing Users
    • Deleting Users
    • Unlocking Users
  • User Group Management
    • Adding User Groups
    • Editing User Groups
    • Deleting User Groups
  • Permissions
    • Administrative Permissions
    • Client Permissions
    • Example of Permissions
• The Audit Log
  • Viewing the Audit Log
  • Audit Log Protection
  • Filtering and Sorting the Log Data
• Windows Clients
  • Monitoring Windows Clients
  • Installing Windows Clients
    • Windows Client Installation Prerequisites
      • Disabling the Sharing Wizard on Windows 8.1/8/7
      • Checking the System Services
      • Configuring the Firewall on Windows 10/8.1/8/7 and Windows Server 2012
      • Configuring the Firewall on Windows Vista, and Windows Server 2003
    • Installing Windows Clients Remotely Using the Management Tool
      • Selecting Computers
      • Installing Windows Clients Remotely
      • Remote Installation from an Existing .INI File
    • Installing Windows Clients Locally
      • The Windows Client Installation Package
      • Generating the Windows Client Installation Package
      • Installing Windows Clients Locally with Custom Monitoring Parameters
      • Downloading the Windows Client Installation (.EXE) File
      • Installing Windows Clients Locally without a .INI File
    • Installing Windows Clients through Group Policy Using a .MSI File
    • Installing Windows Clients Using Third Party Software
    • Installing Windows Clients on Amazon WorkSpaces
    • Installing Windows Clients Remotely Using PsExec
    • Configuring an Ekran System Client Golden Image
    • Cloning a Virtual Machine with the Client Installed on It
    • Unassigning the License on Virtual Machine Shutdown
      • Enabling Golden Image Mode for the Application Server
      • Unassigning the License Using a Script on the Client Side
  • Updating Windows Clients
    • The Windows Client Status after an Application Server Update
    • Updating Windows Clients Automatically
    • Updating Windows Clients Manually
  • Reconnecting Windows Clients to Another Application Server
  • Uninstalling Windows Clients
    • The Client Uninstallation Key
    • Uninstalling Windows Clients Remotely
    • Uninstalling Windows Clients Locally
  • Viewing Windows Clients
  • Windows Client Configuration
    • The Windows Client Description
    • The Protected Mode Parameter
    • The Update Client Automatically Parameter
    • The Display Icon when Recording Parameter
    • The Client Tray Icon Parameter
    • The Jump Server Parameter
    • The Detection of Disconnected Clients Parameter
    • The Windows Event Log Integration Parameter
    • The Auto-Cleanup Parameters
    • The Client Log Level Parameter
    • The Custom Path for the Client Installation Folder Parameter
    • The Offline Cache Size Parameter
    • The User Activity Recording Parameters
    • The Keystroke Logging Parameter
    • The Start Monitoring on Detection of Keyword Parameter
    • The Keystroke Filtering Parameter
    • The Clipboard Monitoring Parameter
    • The Detect System Idle Event Parameter
    • The Register Idle Event Parameter
    • The File Monitoring Parameter
    • The SWIFT Username Monitoring Parameter
    • The Monitoring Log Parameter
    • The URL Monitoring Parameter
    • The Application Filtering Parameters
    • The User Filtering Parameter
    • The Monitoring Time Filtering Parameter
    • The Remote Host IP Filtering Parameter
    • The Secondary User Authentication Parameter
    • The One-Time Password Parameter
    • The Two-Factor Authentication Parameter
    • The Additional Message on User Login Parameter
    • The Require User’s Comment Parameter
    • The Require Ticket Number Parameter
    • The Bandwidth Usage Reduction Parameters
    • The Audio Recording Parameter
  • Editing the Windows Client Configuration
  • Viewing the Windows Client Configuration
  • Secondary User Authentication on Windows Clients
    • Enabling Secondary User Authentication on Windows Clients
    • Granting a User Permission to Log In
    • Logging in Using Secondary Credentials
  • Managing One-Time Passwords
    • Enabling the Use of One-Time Passwords
    • Generating a One-Time Password
      • Generating a One-Time Password Manually
      • Generating a One-Time Password Automatically
      • Generating a One-Time Password without a User Request
    • Logging in Using a One-Time Password
    • Requesting a One-Time Password
  • Informing Users that They are Being Monitored
    • Enabling the Displaying of an Additional Message
    • Enabling the Require User’s Comment Option
    • Enabling the Displaying of the Client Tray Icon
    • Enabling the Displaying of the Client On-Screen Recording Icon
    • Logging in to a Client Computer with the Displaying of an Additional Message Option Enabled
  • Integration with Ticketing Systems
    • Enabling the Require Ticket Number Option
    • Logging in to the Client Computer with the Require Ticket Number Option Enabled
• macOS Clients
  • Monitoring macOS Clients
  • Installing macOS Clients
    • Downloading the macOS Client Installation File
    • Installing macOS Clients Using the Application
    • Installing macOS Clients Using the Command Line
    • Remote Mass Deployment on macOS Clients
      • Remote Mass Deployment on macOS Clients Using Jamf Pro
      • Remote Mass Deployment on macOS Clients Using VMware Workspace ONE UEM
  • Updating macOS Clients
    • The macOS Client Status after an Application Server Update
    • Updating macOS Clients Automatically
    • Updating macOS Clients Manually
  • Uninstalling macOS Clients
    • Uninstalling macOS Clients Remotely
    • Uninstalling macOS Clients Locally
      • Uninstalling macOS Clients Using the Command Line
      • Uninstalling macOS Clients Using the Application
  • Viewing macOS Clients
  • macOS Client Configuration
    • The macOS Client Description
    • The Update Client Automatically Parameter
    • The Detection of Disconnected Clients Parameter
    • The Auto-Cleanup Parameters
    • The Client Log Level Parameter
    • The User Activity Recording Parameters
    • The Clipboard Monitoring Parameter
    • The Detect System Idle Event Parameter
    • The Register Idle Event Parameter
    • The File Monitoring Parameter
    • The URL Monitoring Parameter
• Linux Clients
  • Monitoring Linux Clients
    • Monitoring Remote SSH Sessions
    • Monitoring Local Sessions (for X Window System)
  • Installing Linux Clients
    • Downloading the Linux Client Installation File
    • Installing Linux Clients Using the Installation File
    • Installing SELinux Clients Using the Installation File
    • Installing Linux Clients with Custom Monitoring Parameters (Using a .INI file)
  • Updating Linux Clients
    • The Linux Client Status after an Application Server Update
    • Updating Linux Clients Automatically
    • Updating Linux Clients Manually
  • Uninstalling Linux Clients
  • Viewing Linux Clients
  • Linux Client Configuration
    • The Linux Client Description
    • The Update Client Automatically Parameter
    • The Detection of Disconnected Clients Parameter
    • The Auto-Cleanup Parameters
    • The Client Log Level Parameter
    • The User Activity Recording Parameters
    • The Offline Cache Size Parameter
    • The Command Output Limiting Parameter
    • The Command Output Skipping Parameter
    • The Function Call Skipping Parameter
    • The User Input Monitoring Parameter
    • The User Filtering Parameter
    • The Two-Factor Authentication Parameter
  • Secondary User Authentication on Linux Clients
    • Enabling Secondary User Authentication on Linux Clients
    • Granting a User Permission to Log in to the Terminal
    • Launching the Terminal
• The Tray Notifications Application
  • Installing the Tray Notifications Application
  • Uninstalling the Tray Notifications Application
• Password Management
  • Getting Started with Password Management
  • Using Password Management
  • Jump Server Configuration
  • Secrets Management
    • Viewing Secrets
    • Adding Secrets
      • Adding an Active Directory Account Secret
      • Adding a Windows Account Secret
      • Adding a Unix Account (SSH) Secret
        • Rotation of the Password and SSH Key for Unix Account (SSH) Secrets
      • Adding a Unix Account (Telnet) Secret
      • Adding a Web Account Secret
      • Adding an MS SQL Account Secret
    • Editing Secrets
    • Deleting Secrets
    • Remote Password Rotation
    • Password Checkout
    • Permissions for Secrets
      • Viewing Permissions
  • Using Secrets
• User Behavior Analysis
  • User Behavior Rules Management
    • Viewing Rules
    • Adding Rules
    • Enabling/Disabling Rules
    • Editing Rules
    • Deleting Rules
  • User Profiles Management
    • The User Profiles List
    • Viewing a User Profile
    • Rebuilding a User Profile
  • Abnormal User Sessions Management
    • Approving Abnormal User Sessions
    • Skipping Abnormal User Sessions
    • Canceling the Approval or Skipping of a User Session
  • Receiving Information on Anomalies in User Behavior
• Access Management
  • Access Requests
  • Two-Factor Authentication
  • Endpoint Access Control
    • Administrator Approval on Login
      • Adding Users with Access Restrictions
      • Editing Access Restrictions
      • Removing Access Restrictions
      • Logging into a Client Computer with Administrator Approval
    • Requiring Administrator Approval on Login Only at Specific Times
      • Granting Access Without Approval Only at Specific Times
      • Editing Access Restrictions
      • Removing Access Restrictions
• Blocking Users
  • Blocking a User while Viewing a Live Session
  • Blocking a User from a Finished Session
  • Blocking a User on Triggering an Alert
  • Blocking a User on a Client with Secondary User Authentication Enabled
  • The Blocked Users List
    • Viewing the Blocked Users List
    • Removing Users from Blocked Users List
• Client Group Management
  • Adding Client Groups
  • Editing Client Groups
  • Adding Clients to Client Groups
    • Adding a Client to Client Groups while Editing the Client
    • Adding Clients to a Client Group while Editing the Client Group
  • Applying Client Group Settings to a Client
  • Removing Clients from Client Groups
    • Removing a Client from Client Groups while Editing the Client
    • Removing Clients from a Client Group while Editing the Client Group
    • Managing Client Groups Setting for Multiple Clients Simultaneously
  • Cloning Client Groups
  • Deleting Client Groups
  • Downloading Client Log Files
• Alerts
  • Viewing Alerts
  • Default Alerts
    • Fraudulent Activity
    • Data Leakage
    • Potentially Illicit Activity
    • Non-Work-Related Activity
  • Alerts Management
    • Adding Alerts
    • Alert Rules
      • Examples of Alert Rules
    • Enabling/Disabling Alerts
    • Editing Alerts
      • Editing an Alert
      • Editing Multiple Alerts
    • Assigning Alerts to Clients
      • Assigning an Alert to Clients while Editing the Alert
      • Assigning Alerts to Clients while Managing Multiple Alerts
      • Assigning Alerts to Clients while Editing a Client / Client Group
    • Exporting and Importing Alerts
      • Exporting Alerts
      • Importing Alerts
    • Deleting Alerts
  • Defining Global Alert Settings
  • Getting Information on Alert Events
• Advanced Reports
  • Report Types
  • Report Customization
  • The Report Generator
    • Report Parameters
    • Generating Reports
  • Scheduled Reports
    • Adding Report Rules
    • Editing Report Rules
    • Deleting Report Rules
    • Generating Reports Manually from a Scheduled Report Rule
    • The Time Period and Frequency of Report Creation
  • Viewing Reports Generated
• USB Monitoring & Blocking
  • Monitored Devices
  • Kernel-Level USB Monitoring Rules
    • Adding USB Monitoring Rules
    • Editing USB Monitoring Rules
    • Deleting USB Monitoring Rules
    • Defining Exceptions for USB Monitoring Rules
    • Viewing the Device Hardware ID
  • Approving USB Access by an Administrator
    • Requesting Access to Use a Blocked USB Device
• Health Monitoring
  • The System State
    • Viewing System Errors and Warnings
    • Possible Causes of System Errors and Warnings
    • The Critical Error Threshold
    • Receiving Notifications on Error Events
    • Application Server Resource Monitoring
    • Downloading the Management Tool and Application Server Log Files
  • Disconnected Clients
    • Enabling Detection of Disconnected Clients
    • Viewing Disconnected Clients
  • The Tasks List
• Viewing Monitoring Results
  • Client Sessions
    • The Client Sessions List
    • Filtering Client Sessions
      • Filtering Client Sessions by Specific Parameters
      • Searching the Client Session Data
    • Exporting Client Sessions
      • Forensic Export of Client Sessions
      • Exporting the Client Sessions List to a CSV File
    • Sorting Client Sessions
  • Playing Client Sessions
    • The Session Viewer Interface
    • The Session Player
      • The Magnifier
      • Getting the Data URL
      • Live Sessions
    • The Metadata Grid
      • Searching, Filtering and Sorting the Metadata
      • Synchronization of the Session Player and Metadata
  • Windows Client Sessions
    • Playing Windows Client Sessions
    • Viewing Clipboard Text Data
    • Viewing USB Device Info
    • Viewing URLs
    • Viewing the Idle State
    • Viewing Secrets
    • Viewing File Upload Operations
  • macOS Client Sessions
    • Playing macOS Client Sessions
    • Viewing Clipboard Text Data
    • Viewing the Idle State
    • Viewing File Upload Operations
  • Linux Client Sessions
    • Playing Remote SSH Client Sessions
      • Playing Remote X-Forwarded Client Sessions
    • Playing Local X Window System Client Sessions
  • Viewing the Client Session Risk Score
  • Viewing Alerts Events
  • Archived Client Sessions
    • Changing the Archived Database Being Investigated
    • Viewing Archived Client Sessions
  • Anonymizer
• Dashboards
  • Dashboard Types
    • Clients
    • Storage Usage
    • Licenses
    • Latest Live Sessions
    • Recent Alerts
    • Sessions Outside of Work Hours
    • Rarely Used Computers
    • Rarely Used Logins
    • CPU Usage
    • Memory Usage
    • Database State
  • Customizing Dashboards
• Interactive Monitoring
  • Viewing Data
  • The Applications Monitoring Chart
  • The URL Monitoring Chart
• Forensic Export
  • Exporting a Session
  • Exporting Multiple Sessions
  • Viewing the Forensic Export History
  • Playing an Exported Session
  • Validating Exported Data