The Monitoring Profiles screen lets you create/edit monitoring profiles for users, computers, departments, and Active Directory groups and precisely control how much information will be collected for each monitored system (such as Websites, Apps, Emails, etc.). You can track as much or as little as you want based on your organization's needs and alleviate any privacy concerns.

1. Click the New Profile button to create a new profile.

2. Click the Three Dots in front of a profile to access its context menu:

3. Click the Custom Profile button to view employees who are assigned a Custom Profile:

Clicking on an employee's name will take you to the employee's details page.

Click the Create Profile button near the top-right corner of the Monitoring settings screen. A pop-up window will be displayed.

1. Select users, departments, computers, etc., as the tracking targets for the profile. You can click on an empty space in the field or click the + button to add a target and press the X button to remove a target.

2. Give the profile a name.

3. Optionally, give it a description.

4. Click the Submit button. You will be taken to the Edit monitoring profile screen:

1. Click the Toggle buttons under the What to monitor column to turn monitoring on/off for a monitored system (e.g., Screen Recording, Applications, etc.).

2. Click the Edit button under the Actions column to access additional settings for a monitored system (see the Editing the Settings of Monitored Systems below)

3. Click the Assigned button to view/change the assigned targets (users, computers, departments, etc.) for the profile.

4. Click the Gear button near the top-right corner to open the profile’s settings panel. See the Profile Settings section below to learn more.

The Profile Settings panel comes with two tabs. The Basic tab allows you to change the profile names, targets, monitoring schedule, etc. The Advanced tab gives you access to some advanced options.

Name:

You can change the profile’s name.

Description:

Optionally, change the profile's description.

Assign To:

Optionally, assign employees, departments, and computers to the profile. If you don’t assign anything, “Nobody” will be used.

Click the Advanced tab from the Profile settings screen to access the advanced settings panel:

DLP for processes:

Allows you to exclude certain processes from the DLP scanning (e.g., data discovery and classification) and DLP rules. For example, svchost.exe, System Idle Process, etc. Note that this is different from disabling monitoring for applications using the Monitor only selected apps and keystrokes option on the Applications monitoring settings. That option disables all monitoring for a process (activity will not be captured, and the app will be blacked out on the session recording). On the other hand, Don’t track DLP will only disable DLP scanning for a process.

File driver:

If you leave the Don't track processes below field empty, Teramind File Driver (tmfsdrv2 service) will be stopped on the users’ computers. As a result, File Transfer reports, Content Sharing Rules, Files-Based Activity, etc., will not work. Please see the notes under *FILE DRIVER vs NETWORK DRIVER below.

If you enter specific processes/apps, the driver will remain active, but only those processes/apps will be excluded from the driver. For example, entering explorer.exe into this field will exclude Windows File Explorer. This could be helpful for troubleshooting purposes. Also, with this option, you can ignore processes you don't want to capture while keeping the file transfers monitoring active. Please see the notes under *FILE DRIVER vs NETWORK DRIVER below.

Network driver:

If you leave the Don't track processes below field empty, Teramind Network Driver (tm_filter service) will be stopped on the users’ computers, and the ‘Quick web proxy’ certificate will not be injected into the browsers. As a result, network-based activities will not be tracked, and things like the IM report, Network-Based Rules, File Upload rules, etc., will not work. Please see the notes under *FILE DRIVER vs NETWORK DRIVER below.

If you enter specific processes/apps, the driver will remain active, but only those processes/apps will be excluded from the driver. For example, entering msedge.exe into this field will exclude Microsoft Edge from the network driver. This could be helpful for troubleshooting purposes. Also, with this option, you can ignore processes you don't want to capture while keeping the network monitoring active. Please see the notes under *FILE DRIVER vs NETWORK DRIVER below.

RDP (Remote Desktop Protocol) options:

The setting under these sections applies to RDP (Remote Desktop Protocol) sessions:

Restrictions:

Data upload:

If you have many users or a slow network, the Max upload bandwidth option will help you prevent overloading your network infrastructure by imposing a throttled bandwidth and the asynchronous upload of video/audio recordings. Furthermore, you can use the time slider option so that the uploads take place during off-peak hours only. These options might also be useful if your end users have a slow connection. Here’s how the two settings work:

Click the Three Dots in front of a profile to access its context menu and then select the Preview Profile option to view what settings the profile contains:

You can click the Down/Up Arrows to expand/collapse a row.

A Custom Profile is created automatically when you change the monitoring settings on an employee’s profile.

Click the Custom Profile name or the Custom Profile button on the Monitoring profiles screen to see which employees are using a custom profile:

Clicking on an employee's name will take you to the employee's details page.

Each Monitoring system (except for Offline Recording, OS State, and OCR) has a simple scheduler at the bottom of its settings panel. Using this scheduler, you can quickly specify when the tracking will take place.

Click on a day to enable/disable it. Drag the two slider ends to adjust the time. Click the Reverse icon to reverse the time.

You can press the Apply to all button to apply the schedule to all monitored systems. A warning will appear:

If you click the Apply to all button, it will override the monitoring schedule of all monitored systems.

Remote control:

Allow remote control: this option determines if the Remote Control and Freeze Input features will be available on the Session Player’s Live View Controls.

Messages to display:

During remote control: lets you specify messages to be shown when the Remote control feature is activated on the Session Player.

During input freeze: lets you specify messages to be shown when the Freezing input feature is activated on the Session Player.

If you keep these fields blank, then no messages will be shown to the user. See the Session Player’s Live Mode Controls section to learn more.

Video settings:

Async screen upload: If the user is using a Stealth Agent, this option will force Teramind to use a queue for screen recordings instead of uploading them in real time. It’s suitable for a slower network or a busy OCR server. However, you might experience some delay between the user activity and the recording appearing on the dashboard when this option is enabled.

Record locked sessions: option allows you to continue recording even when the user locks their computer. A locked session can mean the user choosing the “Lock” (“Lock Screen” on Mac) command, a screen saver getting activated, or an RDP (remote desktop session) window minimized (see notes below)*.

Use modern screen grabbing: you should only enable the option on Windows 8 or above. If you are experiencing issues with screen captures, try toggling this option. Modern screen grabbing can often help with visual artifacts seen in the recordings, such as black spots when transparency effects are enabled in Windows 11.

Record only when behavior rule was violated: by enabling this option in combination with the Record Video rule action, you can capture the screen only when a rule is violated. This will help reduce the storage needed for the screen recordings or alleviate privacy concerns.

Update screen on events only: if this option is enabled, the screen in the Live Mode on the Session Player will only update the screen if any activity on the keyboard or mouse is detected or any behavior rule is triggered. Otherwise, the screen will remain still.

Retention period:

Delete history after: this option is applicable to On-Premises customers only. If you specify any days in this field, the video recordings will be automatically deleted after those days. This will reduce your storage requirements and help you comply with data retention policies. Note that currently, Teramind on AWS doesn't support the removal of screen recordings from AWS S3 buckets. You can still use the Amazon S3 Lifecycle (! external link) to manage your storage.

Video quality:

Maximum frames per second (FPS): lets you specify how many frames per second will be captured. The range is 1-4, and the default frame rate is 2 frames per second.

Color and color quality of recodings: the three options, GrayScale / Color / HighColor, let you control the color of the recordings. Note that the HighColor mode is only available in On-Premises deployments and enables recording in 16-bit color compared to the default 8-bit color. It also uses the most space, and the recordings will be close to double the size of recordings without HighColor enabled.

Live screen scaling: lets you control the screen size of the recording.

Monitor keystrokes for password fields in desktop apps:

If this option is enabled, then keystrokes in the password fields will be captured for all desktop apps.

Track window titles:

This gives you the ability to toggle tracking of application titles, including document names in the titles. If you disable this option, the “Title” column on dashboards and reports like Applications & Websites will not show any data. Note that if you turn off this option, the “Applications caption” criterion in the Applications rules might not work properly for all apps.

Track console commands:

You can turn monitoring on/off for console/terminal commands using this option.

Idle time threshold (minutes)*:

You can define the to set the application idle time. It’s used in the productivity reports, Agent Schedule-based rules, and other places by Teramind.

Applications and keystrokes to monitor:

Don’t monitor private browsing:

Turn on this option to suspend monitoring for all private browsing (incognito) sessions. The browser window will be blacked out, and the keystrokes will not be captured from that window. However, the full URL is still captured in the activity log. For this reason, keystrokes might still be captured as part of the URL. For example, when you use a search engine like Google.

Monitor keystrokes for password fields in browser:

You can toggle monitoring of keystrokes in password fields. For example, a login page containing an HTML input field such as <input type="password">*. See the notes below for more information.

Websites to monitor:

Website content:

Don’t monitor websites that contain these words or terms: websites specified in this field will not be monitored if certain text/content is detected inside the loaded webpage. Keystrokes will not be recorded, and the screen will be blacked out. For example, by entering "password" in the field, you can dynamically suspend the login pages of most websites. Note that the text isn't case-sensitive.

IPs to monitor:

Monitor all IPs: This option lets you monitor all IPs. You can add exceptions by clicking the Exception button.

Monitor only selected IPs: this option works the opposite of Monitor all IPs. Click the Add button to add a list of IPs to monitor.

Invalid certificates:

Monitor these hosts with invalid certificates: click the Add button to add websites that have an invalid certificate. In some situations, this might be necessary. Because, by default, Teramind doesn't track connections to a website with a bad SSL certificate. So, for example, if your On-Premises server has a self-signed certificate, downloads from the Teramind Dashboard will not be recognized as web downloads. Adding the IP address of the server in this field will activate SSL traffic decryption so that Teramind will be able to properly parse and present the information on the Dashboard. However, this is not a recommended method, and this option should only be used as a last resort. Please see the notes below.

WSS Port:

This field lets you specify the port for web traffic redirection (Web Security Service). It’s used by the Teramind Agent's network filter driver to monitor web traffic. Generally, you don’t need to change the default port. However, in rare situations, you might need to change it. For example, if an application is using the default/same WSS port, you can assign a different port to the Agent using this field.

Track these applications:

You can select which social media applications will be tracked.

Track these actions on selected applications:

You can select which social media activities will be tracked. Such as Create comment, Edit comment, Create post, Edit post, etc.

Email content:

In the above examples, only emails (a) and (c) will be ignored from monitoring because emails (b) and (d) contain other domains (gmail.com and yahoo.com).

Email attachments:

Emails retention period:

Monitor applications:

In this field, you can specify which online meeting apps to track. Teramind supports monitoring of Zoom, RingCentral, Microsoft Teams, AirCall, Webex, etc.

Monitor these applications:

You can specify which messaging applications to track in this field.

Capture content:

You can track incoming, outgoing, or both types of messages by selecting the options under this section.

Monitoring period:

Monitor clipboard:

Click this option to turn clipboard (copy/paste operation) tracking on/off.

File types:

You can select which file extensions to track under this section, such as .txt, .docx, etc.

Custom file types:

If the files you want to track aren’t available under the File types section, you can use this field to manually enter file extensions. For example, .odm, pkg, etc.

File operations:

You can select which file operation (e.g., Copy, Rename, etc.) to track under this section.

File locations to skip:

If you don’t want certain locations (i.e., folders) to be tracked, you can specify them in this field. For example, Windows, ~/Downloads (to exclude the Download folder in Mac), etc.

File locations to skip (regex):

This field is similar to the above but lets you exclude multiple locations matching the regex pattern. For example: .*upload.*. You can also use local folders (e.g., Documents), network folders (e.g., \\corplan\Shared Drives), environmental/system variables (e.g., %APPDATA%), and wildcards (e.g., c:\user\*\appdata) in the field.

File origin:

This section lets you select which file origin (sources) to track, such as Local files, Network files, External drives, etc.

Cloud files:

This section lets you select which cloud drives to track for file uploads/downloads, such as Google Drive, OneDrive, Box, etc.

Print account credentials:

If you use a printer that requires login permissions, use the User and Password fields to specify the credentials. Otherwise, Teramind will not be able to monitor it.

Exclude printers:

In this field, you can add regular expressions to exclude any printers matching the name. For example, .*epson.

Printing capturing settings:

Retention period:

Delete history after: applicable to On-Premises customers only. If you specify any days in this field, the video recordings will be automatically deleted after those days. This will reduce your storage requirements and help you comply with data retention policies. Note that currently, Teramind on AWS doesn't support the removal of screen recordings from AWS S3 buckets. You can still use the Amazon S3 Lifecycle (! external link) to manage your storage.

Time Threshold:

By default, every time a user changes their location, it’s reported. You can specify a threshold (in seconds) to configure how often the location data will be reported instead. This can be useful in situations where the location changes too often and you don’t want your Geolocation report to be flooded with information. For example, when you are traveling on a train or in a taxi with a laptop, your location may change every minute, and the Geolocation report will show all the updates. With this setting, you can set a wait time before changing a location update.

The default value is 600 (or 10 minutes). A value of 0 will disable this option.

Monitor all input / Monitor all output:

Allows you to enable/disable recording for all input (e.g., microphones, line-in) and all output devices (e.g., speaker, line-out).

Monitor when these apps use the microphone:

This field lets you capture audio only when the microphone is used by select applications. You can use the following in the field:

Note that this option doesn't affect audio output.

Audio settings:

Automatic level adjustment: if this option is enabled, it will automatically adjust the sound levels for higher/lower tones.

Async audio upload: If the user is using a Stealth Agent, this option will force Teramind Agent to use a queue for audio recordings instead of uploading them in real time. It’s suitable for a slower network or a busy server. However, you might experience some delay between the user activity and the recording appearing on the dashboard when Async audio upload is enabled.

Bitrate: You can adjust the audio quality by choosing a bit rate. A higher value will give crisper audio but will use more CPU processing and storage.

OCR languages to process:

This option allows you to pick one or more languages to process.

Process screen start date:

Process screen records after: this option allows you to pick a starting date from which the recordings will be processed. Recordings before this date won’t be processed. This option can be useful if you didn't originally have the OCR feature enabled on your instance and activated it later.

Camera Usage doesn’t come with any additional settings except for the monitoring schedules. If the Camera Usage is turned on, you will be able to detect when employees are using their webcams and the applications that are accessing the webcam from the Camera Usage dashboard.

Offline recording’s buffer length:

This option allows you to specify how long the Teramind Agent will continue to record the screen while the user is disconnected from the internet or the Teramind server. By default, the buffer is set to 24 hours, but you can increase or decrease the time as needed. Note that you cannot enter a 0 value in the field. If you want to disable offline recording completely, turn off the Offline Recording option from a monitoring profile (Monitoring Profiles > Edit monitoring profile screen).

Offline recording’s buffer size limit:

This field is optional and can be used to limit the storage utilization by offline recordings (in megabytes). The default value of 0 means there will be no limit.

Note that if you use both the Offline recording’s buffer length and the Offline recording’s buffer size limit options, the lowest value will be prioritized. For example, if you specify a 24-hour buffer length but a 10-MB buffer size, the Agent will only capture a few minutes of screen recordings (depending on the screen resolution, number of desktops/monitors, user activity, etc.). Same way, if you specified a 999999-MB buffer size but only a 1-hour buffer length, only 1 hour’s worth of screen recordings will be captured, even though the buffer can possibly hold a much longer duration of recordings.

Track these events:

The option allows you to specify which OS states will be tracked. For example, Lock, Sleep, and Screen Saver, etc. These states are sent to any SIEM integration (syslog event) you might have. These settings do not affect the monitoring of these events.

The Registry doesn’t come with any additional settings except for the monitoring schedules.

If the Registry monitoring is turned on, you will be able to detect registry entries such as programs, keys, and values with Activity-based rules.

IP tracking:

Monitor all IPs: if this option is enabled, all IP addresses will be monitored. You can add exceptions by clicking the Exception button.

Monitor only selected IPs: this option works the opposite of the Monitor all IPs option. With this option selected, you can add IPs to monitor by using the Add button.

You can enter IP addresses (e.g., 10.2.33.1) or use Network-based Shared Lists for the above two options.

Ports tracking:

Similar to the IP tracking options above, but allows you to specify ports. For example, 443, 25, etc.

Network processes:

Network processes to track: this field allows you to specify which network processes to track. You can use process names (e.g., chrome.exe, com.apple.safari, etc.), Text-based Shared Lists, or Regular Expressions (Regex)-based Shared Lists.

Network options:

SSL: you can turn this option off to disable monitoring secure connections (i.e., HTTPS / port: 443)*.

Track network connections: this option allows you to turn network monitoring on/off*.

Keep Teredo enabled: this option applies to Windows only. If enabled, this option will prevent Teramind from disabling Teredo. It’s used for secure communication over IPv6. If you encounter any problem with IP tracking, try toggling this setting.