chankendrick Absent Member.
Absent Member.
813 views

Incomplete Session Recording

Hi All,

I have been implementing PAM to a Customer for some time now.

One of the issues i have is the incomplete session recording (keystroke)

So basically, the actvitity to capture was:

1. Go to Local Disk C
2. Go to Temp Folder
3. Create a Folder named PAM Test
4. Inside PAM Test folder create a Notepad named PAM Testing
5. In the PAM testing Notepad type anything you want then save
6. Delete first the PAM Test.txt then the PAM Test Folder


After doing that for 8-10 Windows Hosts (Windows Server 2012 R2 and Windows Server 2008 R2)
Some servers (3-4 server) were complete. Meaning i have seen the keystroke recording from Step 1 to Step 6.

Most of the servers doesnt. It only recorded from Step 4 to Step 5.

At first i thought that only happens to Windows 2012 R2 since the first 2 servers i checked was Windows 2008 R2 and it was complete. But after the 2012 R2 server i've checked another 2008 R2 server and it does the same (Only recording Step 4 and Step 5)

Any idea why this is happening?

All agents are 3.2.0.3. Both Windows 2012 R2 and Windows 2008 R2.
0 Likes
3 Replies
Micro Focus Expert
Micro Focus Expert

Re: Incomplete Session Recording

I have not been able to duplicate this on 3.2.0.4 with Windows being up to date. Please verify Windows is updated. I am receiving all the appropriate audits in my Windows sessions, including the ones you have described with File Explorer.
0 Likes
Micro Focus Expert
Micro Focus Expert

Re: Incomplete Session Recording

Please try restarting the Windows servers that are not capturing these audits appropriately and report back here your results. I suspect some reboot did not happen after a recent update/upgrade that may have resulted in this incomplete audit scenario.
Awaiting your confirmation. Thank you!
0 Likes
gsanjeev Absent Member.
Absent Member.

Re: Incomplete Session Recording

Please re-try the scenario after installing all the available patches patches reboot the server as suggested above. In most cases such issues are due to missing patches or a pending reboot.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.