Configure policies

Use the Session Recording Policy Console to create and activate policies that determine which sessions are recorded and which events are recorded in sessions.

As of the 1903 release, Session Recording adds support for the Citrix Cloud Delivery Controllers. When creating session recording and event logging policies, you can specify Delivery Controllers from both the Citrix Cloud and on-premises environments.

Important:

To use the Session Recording Policy Console, you must have the Broker PowerShell Snap-in (Broker_PowerShellSnapIn_x64.msi) or the Citrix Virtual Apps and Desktops Remote PowerShell SDK (CitrixPoshSdk.exe) installed. The installer does not install the snap-ins automatically. Locate the Broker PowerShell snap-in on the Citrix Virtual Apps and Desktops ISO (\layout\image- full\x64\Citrix Desktop Delivery Controller); locate the Citrix Virtual Apps and Desktops Remote PowerShell (PS) SDK on the Citrix web site. Follow the instructions for installing the snap-in and the SDK manually. Failure to comply can cause an error.

Recording policies

You can activate system-defined recording policies available when Session Recording is installed or create and activate your own custom recording policies. System-defined recording apply a single rule to all users, published applications, and servers. Custom recording policies specifying which users, published applications, and servers are recorded.  

The active recording policy determines which sessions are recorded. Only one recording policy is active at a time.

System-defined recording policies

Session Recording provides the following system-defined recording policies:

  • Do not record. The default policy. If you do not specify another policy, no sessions are recorded.
  • Record everyone with notification. If you choose this policy, all sessions are recorded. A pop-up window appears to notify recording occurrence.
  • Record everyone without notification. If you choose this policy, all sessions are recorded. No pop-up window appears to notify recording occurrence.

You cannot modify or delete the system-defined recording policies.

Create a custom recording policy

When you create your own recording policy, you make rules to specify which users or groups, published applications or desktops, delivery groups or VDA machines, and Citrix Workspace app client IP addresses have their sessions recorded. A wizard within the Session Recording Policy Console helps you create rules. To obtain the list of published applications or desktops and the list of delivery groups or VDA machines, you must have the read permission as a Site administrator. Configure the administrator read permission on the Delivery Controller of the Site.

For each rule you create, you specify a recording action and rule criteria. The recording action applies to sessions that meet the rule criteria.

For each rule, choose one recording action:

  • Do not record. (Choose Disable session recording in the Rules wizard.) This recording action specifies that sessions meeting the rule criteria are not recorded.
  • Record with notification. (Choose Enable session recording with notification in the Rules wizard.) This recording action specifies that sessions meeting the rule criteria are recorded. A pop-up window appears to notify recording occurrence.
  • Record without notification. (Choose Enable session recording without notification in the Rules wizard.) This recording action specifies that sessions meeting the rule criteria are recorded. Users are unaware that they are being recorded.

For each rule, choose at least one of the following items to create the rule criteria:

  • Users or Groups. Creates a list of users or groups to which the action of the rule applies. Session Recording allows you to use Active Directory groups and white list users.
  • Published Applications or Desktop. Creates a list of published applications or desktops to which the action of the rule applies. In the Rules wizard, choose the Citrix Virtual Apps and Desktops Site or Sites on which the applications or desktops are available.
  • Delivery Groups or Machines. Creates a list of Delivery Groups or machines to which the action of the rule applies. In the Rules wizard, choose the location of the Delivery Groups or machines.
  • IP Address or IP Range. Creates a list of IP addresses or ranges of IP addresses to which the action of the rule applies. On the Select IP Address and IP Range screen, add a valid IP address or IP range for which recording is enabled or disabled. The IP addresses mentioned here are the IP addresses of the Citrix Workspace apps.

Note:

The Session Recording Policy Console supports configuring multiple criteria within a single rule. When a rule applies, both the “AND” and the “OR” logical operators are used to compute the final action. Generally speaking, the “OR” operator is used between items within a criterion, and the “AND” operator is used between separate criteria. If the result is true, the Session Recording policy engine takes the rule’s action. Otherwise, it goes to the next rule and repeats the process.

When you create more than one rule in a recording policy, some sessions might match the criteria for more than one rule. In these cases, the rule with the highest priority is applied to the sessions.

The recording action of a rule determines its priority:

  • Rules with the Do not record action have the highest priority
  • Rules with the Record with notification action have the next highest priority
  • Rules with the Record without notification action have the lowest priority

Some sessions might not meet any rule criteria in a recording policy. For these sessions, the action of the policy fallback rule applies. The action of the fallback rule is always Do not record. You cannot modify or delete the fallback rule.

To create a custom recording policy:

  1. Log on as an authorized Policy Administrator to the server where the Session Recording Policy Console is installed.
  2. Start the Session Recording Policy Console and select Recording Policies in the left pane. From the menu bar, choose Add New Policy.
  3. Right-click the New policy and select Add Rule.
  4. Select a recording option - In the Rules wizard, select Disable session recording, Enable Session Recording with notification (or without notification), and then click Next.
  5. Select the rule criteria - You can choose one or more rule criteria:
    Users or Groups
    Published Applications or Desktop
    Delivery Groups or Machines
    IP Address or IP Range 
  6. Edit the rule criteria - To edit, click the underlined values. The values are underlined based on the criteria you chose in the previous step.

    Note:

    If you choose the Published Applications or Desktop underlined value, the Site Address is the IP address, a URL, or a machine name if the Controller is on a local network. The Name of Application list shows the display name.

    When choosing Published Applications or Desktop or Delivery Groups or Machines, specify the Delivery Controller for your Session Recording Policy Console to communicate with.

    The Session Recording Policy Console is the only channel to communicate with Delivery Controllers from the Citrix Cloud and on-premises environments.

    image of select rule criteria

    For example, when choosing Delivery Groups or Machines, click the corresponding hyperlink in Step 3 of the preceding screenshot and click Add to add queries to the Controller.

    image of create query to controller

    For a description of use cases that cover the on-premises and the Citrix Cloud Delivery Controllers, see the following table:

    Use Case Action Required
    On-Premises Delivery Controller 1. Install Broker_PowerShellSnapIn_x64.msi. 2. Clear the Citrix Cloud Controller check box.
    Citrix Cloud Delivery Controller 1. Install the Citrix Virtual Apps and Desktops Remote PowerShell SDK. 2. Validate the Citrix Cloud account credentials. 3. Select the Citrix Cloud Controller check box.
    Switch from an on-premises Delivery Controller to a Citrix Cloud Delivery Controller 1. Uninstall Broker_PowerShellSnapIn_x64.msi and restart the machine. 2. Install the Citrix Virtual Apps and Desktops Remote PowerShell SDK. 3. Validate the Citrix Cloud account credentials. 4. Select the Citrix Cloud Controller check box.
    Switch from a Citrix Cloud Delivery Controller to an on-premises Delivery Controller 1. Uninstall the Citrix Virtual Apps and Desktops Remote PowerShell SDK and restart the machine. 2. Install Broker_PowerShellSnapIn_x64.msi. 3. Clear the Citrix Cloud Controller check box.

    Validating the Citrix Cloud credentials

    To query Delivery Controllers hosted in the Citrix Cloud, manually validate your Citrix Cloud credentials on the machine where the Session Recording Policy Console is installed. Failure to comply can cause an error and your Session Recording Policy Console might not work as expected.

    To do the manual validation:

    1. Log on to the Citrix Cloud console and locate Identity and Access Management > API Access. Create an API access Secure Client for obtaining an authentication profile that can bypass the Citrix Cloud authentication prompts. Download your Secure Client, rename and save it in a safe location. The file name is defaulted to secureclient.csv.

      image of validating ctrix cloud credentials

    2. Open a PowerShell session and run the following command to have the authentication profile (obtained in the preceding step) take effect.

      asnp citrix.*
      Set-XDCredentials -CustomerId “citrixdemo” -SecureClientFile “c:\temp\secureclient.csv” -ProfileType CloudAPI –StoreAs “default”
      
      

      Set CustomerId and SecureClientFile as required. The preceding command creates a default authentication profile for customer “citrixdemo” to bypass authentication prompts in the current and all subsequent PowerShell sessions.

  7. Follow the wizard to finish the configuration.

Note: Limitation regarding prelaunched application sessions:

  • If the active policy tries to match an application name, the applications launched in the prelaunched session are not matched, which results in the session not being recorded.
  • If the active policy records every application, when a user logs on to Citrix Workspace app for Windows (at the same time that a prelaunched session is established), a recording notification appears and the prelaunched (empty) session and any applications to be launched in that session going forward are recorded.

As a workaround, publish applications in separate Delivery Groups according to their recording policies. Do not use an application name as a recording condition. This ensures that prelaunched sessions can be recorded. However, notifications still appear.

Use Active Directory groups

Session Recording allows you to use Active Directory groups when creating policies. Using Active Directory groups instead of individual users simplifies creation and management of rules and policies. For example, if users in your company’s finance department are contained in an Active Directory group named Finance, you can create a rule that applies to all members of this group by selecting the Finance group in the Rules wizard when creating the rule.

White list users

You can create Session Recording policies ensuring that the sessions of some users in your organization are never recorded. This case is called white listing these users. White listing is useful for users who handle privacy-related information or when your organization does not want to record the sessions of a certain class of employees.

For example, if all managers in your company are members of an Active Directory group named Executive, you can ensure that sessions of these users are never recorded by creating a rule that disables session recording for the Executive group. While the policy containing this rule is active, no sessions of members of the Executive group are recorded. The sessions of other members of your organization are sessions recorded based on other rules in the active policy.

Configure Director to use the Session Recording Server

You can use the Director console to create and activate the recording policies.

  1. For an HTTPS connection, install the certificate to trust the Session Recording Server in the Trusted Root Certificates of the Director server.
  2. To configure the Director server to use the Session Recording Server, run the C:\inetpub\wwwroot\Director\tools\DirectorConfig.exe /configsessionrecording command.
  3. Type the IP address or FQDN of the Session Recording Server and the port number and connection type (HTTP/HTTPS) that the Session Recording Agent uses to connect to the Session Recording Broker on the Director server.

Event logging policies

Session Recording supports centralized configuration of event logging policies. You can create policies in the Session Recording Policy Console to log various events.

Note:

To log the insertion of USB mass storage devices and the application starts and ends, upgrade the Session Recording Administration components (Session Recording Database, Session Recording Server, and Session Recording Policy Console) and the Session Recording Agent to Version 1811 or later.
To log file operation events and web browsing activities, upgrade the Session Recording Administration components (Session Recording Database, Session Recording Server, and Session Recording Policy Console) and the Session Recording Agent to Version 1903 or later.

System-defined event logging policy

The system-defined event logging policy is Do not log. It is inactive by default. When it is active, no events are logged.

You cannot modify or delete the system-defined event logging policy.

Create a custom event logging policy

When you create your own event logging policy, you make rules to specify which users or groups, published applications or desktops, delivery groups or VDA machines, and Citrix Workspace app client IP addresses have specific events logged during session recording. A wizard within the Session Recording Policy Console helps you create rules. To obtain the list of published applications or desktops and the list of delivery groups or VDA machines, you must have the read permission as a Site administrator. Configure the administrator read permission on the Delivery Controller of the Site.

To create a custom event logging policy:

  1. Log on as an authorized Policy Administrator to the server where the Session Recording Policy Console is installed.

  2. Start the Session Recording Policy Console. By default, there is no active event logging policy.

    localized image

  3. Select Event Logging Policies in the left pane. From the menu bar, choose Add New Policy to create an event logging policy.

  4. (Optional) Right-click the new event logging policy and rename it.

    image of renaming an event logging policy

  5. Right-click the new event logging policy and select Add Rule.

    1. Specify one or more target events to monitor by selecting the check box next to each event type.

      image of event types

      • Log CDM mapped USB events: Logs the insertion of a Client Drive Mapping (CDM) mapped mass storage device in a client device where Citrix Workspace app for Windows or for Mac is installed, and tags the event in the recording.

      • Log generic redirected USB events: Logs the insertion of a generic redirected mass storage device in a client device where Citrix Workspace app for Windows or for Mac is installed, and tags the event in the recording.

      • Log app start events: Logs the starts of target applications and tags the event in the recording.

      • Log app end events: Logs the ends of target applications and tags the event in the recording.

        Note:

        Session Recording cannot log the end of an application without logging its start. Therefore, in the Rules wizard, the Log app end events check box is grayed out before you select Log app start events.

      • App monitoring list: When you select Log app start events and Log app end events, use the App monitoring list to specify target applications to monitor and to avoid excessive amount of events from flooding the recordings. No application is specified by default, which means no application is captured by default.

        Note:

        • To capture the start and end of an application, add the process name of the application in the App monitoring list. For example, to capture the start of Remote Desktop Connection, add the process name mstsc.exe in the App monitoring list.
        • Separate process names with a semicolon (;).
        • Only exact match is supported. Wildcards are not supported.
        • Process names you add are case-insensitive.
        • To avoid excessive amount of events from flooding the recordings, do not add any system process names (for example, explorer.exe) and web browsers in the registry.
      • Log file operation events: Logs the operations on target files in the recording.

      • File monitoring list: When you select Log sensitive file events, use the File monitoring list to specify target files to monitor. You can specify folders to capture all files within them. No file is specified by default, which means no file is captured by default.

        Note:

        • To capture renaming, creation, deletion, or moving operations on a file, add the path string of the file folder (not the file name or the root path of the file folder) in the FileOperationMonitorList. For example, to capture renaming, creation, deletion, and moving operations on the sharing.ppt file in C:\User\File, add the path string C:\User\File in the FileOperationMonitorList.
        • Both local file paths and remote shared folder paths are supported. For example, to capture operations on the RemoteDocument.txt file in the \\remote.address\Documents folder, add the path string \\remote.address\Documents in the FileOperationMonitorList.
        • FileOperationMonitorList is a multi-string registry. Each string added must end with a CRLF. The maximum length of each string is 247 characters. Strings exceeding the maximum length are ignored.
        • Only exact matches are supported. Wildcards are not supported.
        • Path strings are case-insensitive.

        Limitations:

        • Moving files or folders from an unmonitored local folder to a monitored local folder cannot be captured.
        • When the length of a file or folder path including the file or folder name exceeds the maximum length (260 characters), operations on the file or folder cannot be captured.
        • Pay attention to the database size. To prevent large numbers of events from being captured, back up or delete the “Event” table regularly.
        • When large numbers of events are captured at time intervals, the Player displays and the database stores only one event item for each event type to avoid storage expansion.
      • Log browser usage events: Logs user activities on supported browsers and tags the browser name, URL, and page title in the recording.

        image of web browsing activity

        List of supported browsers:

        Browser Version Language requirement
        Chrome 69 and later English
        Internet Explorer 11 English
        Firefox 61 and later English

        Note:

        Only the English versions of the listed browsers can be captured.

    2. Select and edit the rule criteria.

      Similar to creating a custom recording policy, you can choose one or more rule criteria: Users or Groups, Published Applications or Desktop, Delivery Groups or Machines, and IP Address or IP Range. For more information, see the instructions in the Create a custom recording policy section.

      Note:

      Some sessions might not meet any rule criteria in an event logging policy. For these sessions, the event logging action of the fallback rule applies, which is always Do not log. You cannot modiy or delete the fallback rule.

    3. Follow the wizard to complete the configuration.

      image of complete rule setup

Compatibility with registry configurations

When Session Recording is newly installed or upgraded, no active event logging policy is available by default. At this time, each Session Recording Agent respects the registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\SmartAuditor\SessionEvents to determine whether to log specific events. For a description of the registry keys, see the following table:

Registry Key Description
EnableSessionEvents 1: enables event logging globally; 0: disables event logging globally (default value).
EnableCDMUSBDriveEvents 1: enables logging the insertion of CDM mapped USB mass storage devices; 0: disables logging the insertion of CDM mapped USB mass storage devices (default value).
EnableGenericUSBDriveEvents 1: enables logging the insertion of generic redirected USB mass storage devices; 0: disables logging the insertion of generic redirected USB mass storage devices (default value).
EnableAppLaunchEvents 1: enables logging only application starts; 2: enables logging both application starts and ends; 0: disables logging application starts and ends (default value).
AppMonitorList Specifies target applications to monitor. No application is specified by default, which means no application is captured by default.
EnableFileOperationMonitorEvents 1: enables logging file operations; 0: disables logging file operations (default value).
FileOperationMonitorList Specifies target folders to monitor. No folder is specified by default, which means no file operation is captured by default.
EnableBrowserUsageEvents 1: enables logging web browsing activities; 0: disables logging web browsing activities (default value).

Here are some compatible scenarios:

  • Session Recording 1903 is newly installed or upgraded from a previous release (earlier than 1811) that does not support event logging, the values of the related registry keys on each Session Recording Agent are the default. Because there is no active event logging policy by default, no events are logged.

  • If Session Recording 1903 is upgraded from a previous release (earlier than 1811) that supports event logging but has the feature disabled before your upgrade, the values of the related registry keys on each Session Recording Agent remains the default. Because there is no active event logging policy by default, no events are logged.

  • If Session Recording 1903 is upgraded from a previous release (earlier than 1811) that supports event logging and has the feature partially or fully enabled before your upgrade, the values of the related registry keys on each Session Recording Agent remains the same. Because there is no active event logging policy by default, the event logging behavior remains the same.

  • If Session Recording 1903 is upgraded from 1811, the event logging policies configured in the Policy Console remain in use.

Caution:

When you activate the system-defined or a custom event logging policy in the Session Recording Policy Console, the relevant registry settings on each Session Recording Agent are ignored and you cannot use registry settings for event logging any longer.

Activate a policy

  1. Log on as an administrator to the machine where you installed the Session Recording Policy Console.
  2. Start the Session Recording Policy Console.
  3. If the Connect to Session Recording Server window appears, ensure that the name of the Session Recording Server, protocol, and port are correct. Click OK.
  4. In the Session Recording Policy Console, expand Recording Policies or Event Logging Policies as required.
  5. Select the policy to activate.
  6. From the menu bar, choose Activate Policy.

Modify a policy

  1. Log on as an administrator to the machine where you installed the Session Recording Policy Console.
  2. Start the Session Recording Policy Console.
  3. If the Connect to Session Recording Server window appears, ensure that the name of the Session Recording Server, protocol, and port are correct. Click OK.
  4. In the Session Recording Policy Console, expand Recording Policies or Event Logging Policies as required.
  5. Select the policy you want to modify. The rules for the policy appear in the right pane.
  6. To add, modify, or delete a rule:
    • From the menu bar, choose Add New Rule. If the policy is active, a pop-up window appears requesting confirmation of the action. Use the Rules wizard to create a rule.
    • Select the rule you want to modify, right-click, and choose Properties. Use the Rules wizard to modify the rule.
    • Select the rule you want to delete, right-click, and choose Delete Rule.

Delete a policy

Note:

You cannot delete a system-defined policy or a policy that is active.

  1. Log on as an administrator to the machine where you installed the Session Recording Policy Console.
  2. Start the Session Recording Policy Console.
  3. If the Connect to Session Recording Server window appears, ensure that the name of the Session Recording Server, protocol, and port are correct. Click OK.
  4. In the Session Recording Policy Console, expand Recording Policies or Event Logging Policies as required.
  5. In the left pane, select the policy to delete. If the policy is active, you must activate another policy.
  6. From the menu bar, choose Delete Policy.
  7. Select Yes to confirm the action.

Understand rollover behavior

When you activate a policy, the previously active policy remains in effect until the session being recorded ends or the session recording file rolls over. Files roll over when they have reached the maximum size. For more information about the maximum file size for recordings, see Specify file size for recordings.

The following table details what happens when you apply a new recording policy while a session is being recorded and a rollover occurs:

If the previous recording policy was: And the new recording policy is: After a rollover, the recording policy will be:
Do not record Any other policy No change. The new policy takes effect only when the user logs on to a new session.
Record without notification Do not record Recording stops.
Record without notification Record with notification Recording continues and a notification message appears.
Record with notification Do not record Recording stops.
Record with notification Record without notification Recording continues. No message appears the next time a user logs on.