Configure session recording policies

You can activate system-defined recording policies or create and activate your own custom recording policies. System-defined recording policies apply a single rule to entire sessions. Custom recording policies specify which sessions are recorded.

The active recording policy determines which sessions are recorded. Only one recording policy is active at a time.

Note:

After you create or activate a recording policy, the policy applies to all Session Recording servers of the selected site. You can create and activate separate recording policies for different sites.

Session recording policies

System-defined recording policies

Session Recording provides the following system-defined recording policies:

  • Do not record. The default policy. If you do not specify another policy, no sessions are recorded.

  • Record only events (for everyone, with notification). This policy records only events that your event detection policy specifies. It does not record screens. Users receive recording notifications in advance.

  • Record only events (for everyone, without notification). This policy records only events that your event detection policy specifies. It does not record screens. Users do not receive recording notifications.

  • Record entire sessions (for everyone, with notification). This policy records entire sessions (screens and events). Users receive recording notifications in advance.

  • Record entire sessions (for everyone, without notification). This policy records entire sessions (screens and events). Users do not receive recording notifications.

You can’t modify or delete the system-defined recording policies.

Create a custom recording policy

You can record sessions of specified users or groups, published applications or desktops, delivery groups or VDA machines, and Citrix Workspace app client IP addresses. To obtain the lists of published applications or desktops and delivery groups or VDA machines, you must have the read permission as a site administrator. Configure the administrator read permission on the Delivery Controller of the site.

For each rule you create, you specify a recording action and a rule scope. The recording action applies to sessions that fall into the rule scope.

For each rule, choose one recording action:

  • Enable session recording with notification. Records entire sessions (screens and events). Users receive recording notifications in advance.

  • Enable session recording without notification. Records entire sessions (screens and events). Users do not receive recording notifications.

  • Enable event only session recording with notification. Records throughout sessions only events that your event detection policy specifies. Does not record screens. Users receive recording notifications in advance.

  • Enable event only session recording without notification. Records throughout sessions only events that your event detection policy specifies. Does not record screens. Users do not receive recording notifications.

  • Disable session recording. Does not record sessions of the specified scope.

    Recording action and rule scope

For each rule, choose at least one of the following items to create the rule scope. When a rule applies, both the “AND” and the “OR” logical operators are used to compute the final action. Generally speaking, the “OR” operator is used within a rule item, and the “AND” operator is used between separate rule items. If the result is true, the Session Recording policy engine takes the rule’s action. Otherwise, it goes to the next rule and repeats the process.

  • Users and user groups. Creates a list of users and user groups to which the action of the rule applies. Session Recording allows you to use Active Directory groups and white list users.
  • Published applications and desktops. Creates a list of published applications and desktops to which the action of the rule applies. Citrix DaaS (formerly Citrix Virtual Apps and Desktops service) sites are selected by default. Citrix Virtual Apps and Desktops sites are not supported.
  • Delivery groups and VDA machines. Creates a list of delivery groups and VDA machines to which the action of the rule applies.
  • IP addresses and IP address ranges.. Creates a list of IP addresses and ranges of IP addresses to which the action of the rule applies. The IP addresses mentioned here are the IP addresses of the Citrix Workspace apps.

When you create more than one rule in a recording policy, some sessions might match the criteria for more than one rule. In these cases, the rule with the highest priority is applied to the sessions.

The recording action of a rule determines its priority:

  • Rules with the Do not record action have the highest priority.
  • Rules with the Record with notification action have the second-to-highest priority.
  • Rules with the Record without notification action have the second-to-lowest priority.
  • Rules with the Enable event only session recording with notification action have the medium priority.
  • Rules with the Enable event only session recording without notification action have the lowest priority.

Some sessions might not meet any rule in a recording policy. For these sessions, the action of the policy fallback rule applies. The action of the fallback rule is always Do not record. You cannot modify or delete the fallback rule.

Use Active Directory groups

Session Recording allows you to use Active Directory groups when creating policies. Using Active Directory groups instead of individual users simplifies the creation and management of rules and policies. For example, if users in your company’s finance department are contained in an Active Directory group named Finance, you can create a rule that applies to all the group members by selecting the Finance group in the Rules wizard.

White list users

You can create Session Recording policies ensuring that the sessions of some users in your organization are never recorded. This case is called white listing these users. White listing is useful for users who handle privacy-related information or when your organization does not want to record the sessions of a certain class of employees.

For example, if all managers in your company are members of an Active Directory group named Executive, you can ensure that sessions of these users are never recorded by creating a rule that disables session recording for the Executive group. While the policy containing this rule is active, no sessions of members of the Executive group are recorded. The sessions of other members of your organization are sessions recorded based on other rules in the active policy.

Understand rollover behavior

When you activate a policy, the previously active policy remains in effect until the session being recorded ends or the session recording file rolls over. Files roll over when they have reached the maximum size. For more information about the maximum file size for recordings, see Specify file size for recordings.

The following table details what happens when you apply a new recording policy while a session is being recorded and a rollover occurs:

If the previous recording policy was: And the new recording policy is: After a rollover, the recording policy will be:
Do not record Any other policy No change. The new policy takes effect only when the user logs on to a new session.
Record without notification Do not record Recording stops.
Record without notification Record with notification Recording continues and a notification message appears.
Record with notification Do not record Recording stops.
Record with notification Record without notification Recording continues. No message appears the next time a user logs on.

Video about configuring policies

Video about configuring policies

Configure session recording policies