I have been implementing PAM to a Customer for some time now.
One of the issues i have is the incomplete session recording (keystroke)
So basically, the actvitity to capture was:
1. Go to Local Disk C
2. Go to Temp Folder
3. Create a Folder named PAM Test
4. Inside PAM Test folder create a Notepad named PAM Testing
5. In the PAM testing Notepad type anything you want then save
6. Delete first the PAM Test.txt then the PAM Test Folder
After doing that for 8-10 Windows Hosts (Windows Server 2012 R2 and Windows Server 2008 R2)
Some servers (3-4 server) were complete. Meaning i have seen the keystroke recording from Step 1 to Step 6.
Most of the servers doesnt. It only recorded from Step 4 to Step 5.
At first i thought that only happens to Windows 2012 R2 since the first 2 servers i checked was Windows 2008 R2 and it was complete. But after the 2012 R2 server i've checked another 2008 R2 server and it does the same (Only recording Step 4 and Step 5)
Any idea why this is happening?
All agents are 184.108.40.206. Both Windows 2012 R2 and Windows 2008 R2.