The User Filtering Parameter


User filtering allows you to reduce the amount of information received from the Windows Client by defining Client computer users whose data will be skipped during monitoring.

User filtering affects both primary and secondary users.


User filtering can be performed in one of the following three states by selecting the option required in the Filter State drop-down list (on the Editing Client / Editing Client Group page, on the User Filtering tab, in the User Filtering section):

• Disabled: The activity of all users is monitored.

• Monitor only the activity of selected users: The activity of predefined users is monitored. Information on the activity of all other users is skipped.

• Monitor the activity of all users except: The activity of all users except predefined ones is monitored. This mode allows you to skip information about the activity of specific users (e.g. the administrator).


You can define user names for filtering by entering them manually, or by clicking the Add Users button and then selecting the required users from the list.

When you enter user names manually, they must be entered as <domain or computer name>\<user name>. To specify all users of a domain group, you can enter the domain group manually in the format $<domain name>\<domain user group name> without having to enter each user name separately.

The values entered must be separated by commas, semicolons, or new line characters. You can also use an asterisk as a domain, computer, user or domain group mask (e.g. *\admin*;$*\Administrator*).

When you click the Add Users button, a pop-up window opens. Only those users whose activities have already been monitored are listed in the pop-up window. Select the user names to be added, and then click Add.

NOTE: If you select a user with secondary user authentication in the pop-up window (e.g. “WORK\janet (jan)”), you need to delete the parentheses in the field below, and instead add a semicolon (i.e. “WORK\janet;jan”).


Examples of parameters:

        .ini File Parameter

        Parameter Defined in the Management Tool

Monitor all user activity without applying any filters.

[FilterParameters]

UserFilterState=disable

UserFilterNames=

On the User Filtering tab, in the User Filtering section, in the Filter State drop-down list, make sure that Disabled is selected.

Monitor only the activity of the user “janet” or the user “joe, in the “work domain.

[FilterParameters]

UserFilterState=include

UserFilterNames=WORK\janet;WORK\joe

On the User Filtering tab, in the User Filtering section, do the following:

1. In the Filter State drop-down list, select Monitor only the activity of selected users.

2. In the field below it, enter “work\janet;work\joe” manually, or select the users from the list by clicking the Add Users button.

Monitor the activity of all users except users with the login “administrator (both local and domain users).

[FilterParameters]

UserFilterState=exclude

UserFilterNames=*\administrator

On the User Filtering tab, in the User Filtering section, do the following:

1. In the Filter State drop-down list, select Monitor activity of all users except.

2. In the field below it, enter “*\administrator” using an asterisk as a name/domain mask.

Monitor only the activity of the Ekran System user “janet used for secondary user authentication.

[FilterParameters]

UserFilterState=include

UserFilterNames=WORK\janet;janet

On the User Filtering tab, in the User Filtering section, do the following:

1. In the Filter State drop-down list, select Monitor only the activity of selected users.

2. In the field below it, enter “work\janet;janet” manually, or select the user from the list by clicking the Add Users button.

Monitor only the activity of all users in the “work domain user group of the “company domain.

[FilterParameters]

UserFilterState=include

UserFilterNames=$company\work

On the User Filtering tab, in the User Filtering section, do the following:

1. In the Filter State drop-down list, select Monitor only the activity of selected users.

2. In the field below it, enter “$company\work” manually.