The Monitoring Profiles screen gives you granular control over your monitoring settings.

You can create tailored profiles for users, computers, departments, and Active Directory groups to dictate exactly what data is captured. Use these profiles to specify the level of collection for every channel (Screen Recording, Applications, Websites, Emails, etc.). This flexibility ensures you only track what's necessary, allowing you to easily balance your organizational needs with user privacy.

1. Click the New Profile button to create a new profile.

2. Click the Three Dots in front of a profile to access its context menu:

3. Click the Custom Profile button to view employees who are assigned a Custom Profile:

Clicking on an employee's name will take you to the employee's details page.

Click the Create Profile button near the top-right corner of the Monitoring settings screen. A pop-up window will be displayed.

1. Select users, departments, computers, etc., as the tracking targets for the profile. You can click on an empty space in the field or click the + button to add a target and press the X button to remove a target.

2. Give the profile a name.

3. Optionally, give it a description.

4. Click the Submit button. You will be taken to the Edit monitoring profile screen:

5. Click the Toggle buttons under the What to monitor column to enable or disable monitoring for a specific monitoring channel, such as Screen Recording, Applications, Websites, etc.

6. Click the Edit button under the Actions column to configure granular settings for each monitoring channel. See the Editing the Settings of Monitored Channels below for more information.

7. Click the Assigned button to view and modify which users, computers, or departments will be monitored.

8. Click the Gear button at the top-right to open the profile's settings panel. See the Profile Settings section below to learn more.

9. Click the Clock button to apply a single monitoring schedule to multiple monitoring channels at once, rather than setting each one individually. See the Monitoring Schedule section to learn more about monitoring schedule.

The Profile Settings panel comes with two tabs. The Basic tab allows you to change the profile names, targets, monitoring schedule, etc. The Advanced tab gives you access to some advanced options.

Name:

You can change the profile’s name.

Description:

Optionally, change the profile's description.

Click the Advanced tab from the Profile settings screen to access the advanced settings panel:

DLP for processes:

The DLP for processes setting allows for the exclusion of specific processes from DLP scanning (i.e., Content Sharing rules). For example, you might exclude system processes like svchost.exe or System Idle Process. It is important to note that this is different from the Monitor only selected apps and keystrokes option in Applications monitoring settings. While that option disables all monitoring for a process (no activity capture, blacked out session recordings), the DLP for processes option only disables DLP scanning for the specified processes.

File driver:

The File driver setting controls the Teramind File Driver service (tmfsdrv2). If you disable the toggle button, the service will stop on user computers, resulting in the failure of features such as File Transfer reports, Content Sharing Rules, and Files-Based Activity. Please see the notes under Impact of Disabling the File / Network Driver below.

If the File driver toggle is enabled, a Don't track processes below field will appear. By entering specific processes or applications, you can exclude only those processes from the driver's tracking. For example, entering explorer.exe into this field will exclude Windows File Explorer. This is useful for troubleshooting or ignoring processes you do not wish to capture, while keeping general file transfers monitoring active. If this field is left empty, all file processes will be tracked by default.

Network driver:

The Network driver setting manages the Teramind Network Driver service (tm_filter). Disabling this toggle stops the service and prevents Teramind's 'Quick Web Proxy' certificate from being injected into browsers. Consequently, network-based activities will not be tracked, which disables features like the IM report, Network-Based Rules, and File Upload rules. Please see the notes under Impact of Disabling the File / Network Driver below.

Similar to the File driver, enabling the Network driver toggle reveals a Don't track processes below field. Entering processes here, will exclude only those specific processes from the network driver. For example, entering msedge.exe into this field will exclude Microsoft Edge from the network driver. This is helpful for troubleshooting or allowing certain apps to bypass network capture while keeping general network monitoring active. If the field remains empty, all network processes will be tracked.

RDP (Remote Desktop Protocol) options:

Restrictions:

Data upload:

These settings are designed to manage network traffic when transferring user data from the endpoint to the server. They are especially useful for organizations with many users or a slow network connection. These controls help prevent network overload by throttling bandwidth and scheduling the upload time.

If you have many users or a slow network, the Max upload bandwidth option will help you prevent overloading your network infrastructure by imposing a throttled bandwidth and the asynchronous upload of video/audio recordings. Furthermore, you can use the time slider option so that the uploads take place during off-peak hours only. These options might also be useful if your end users have a slow connection. Here’s how the two settings work:

Disabling either the File Driver or the Network Driver significantly alters which activities Teramind can monitor and capture. The following sections detail the specific impact of disabling each driver on various activity types.

File Driver

Disabling the File Driver primarily impacts local file operations and certain app-based communications, though general application and web activities remain tracked:

Network Driver

Disabling the Network Driver primarily affects network-based activities, especially web uploads, web emails, and instant messaging:

Click the Three Dots in front of a profile to access its context menu and then select the Preview Profile option to view what settings the profile contains:

You can click the Down/Up Arrows to expand/collapse a row.

A Custom Profile is created automatically when you change the monitoring settings on an employee’s profile.

Click the Custom Profile name or the Custom Profile button on the Monitoring profiles screen to see which employees are using a custom profile:

Clicking on an employee's name will take you to the employee's details page.

Each monitoring channel (except for Offline Recording, OS State, and OCR) has a simple scheduler at the bottom of its settings panel. Using this scheduler, you can quickly specify when the tracking will take place.

Click on a day to enable/disable it. Drag the two slider ends to adjust the time. Click the Reverse icon to reverse the time.

You can press the Apply to all button to apply the schedule to all monitoring channels. A warning will appear:

If you click the Apply to all button, it will override the monitoring schedule of all monitoring channel.

Remote control:

Allow remote control: this option determines if the Remote Control and Freeze Input features will be available on the Session Player’s Live View Controls.

Messages to display:

During remote control: lets you specify messages to be shown when the Remote control feature is activated on the Session Player.

During input freeze: lets you specify messages to be shown when the Freezing input feature is activated on the Session Player.

If you keep these fields blank, then no messages will be shown to the user. See the Session Player’s Live Mode Controls section to learn more.

Video settings:

Async screen upload: If the user is using a Stealth Agent, this option will force Teramind to use a queue for screen recordings instead of uploading them in real time. It’s suitable for a slower network or a busy OCR server. However, you might experience some delay between the user activity and the recording appearing on the dashboard when this option is enabled.

Record locked sessions: option allows you to continue recording even when the user locks their computer. A locked session can mean the user choosing the “Lock” (“Lock Screen” on Mac) command, a screen saver getting activated, or an RDP (remote desktop session) window minimized (see notes below)*.

Use modern screen grabbing: you should only enable the option on Windows 8 or above. If you are experiencing issues with screen captures, try toggling this option. Modern screen grabbing can often help with visual artifacts seen in the recordings, such as black spots when transparency effects are enabled in Windows 11.

Record only when behavior rule was violated: by enabling this option in combination with the Record Video rule action, you can capture the screen only when a rule is violated. This will help reduce the storage needed for the screen recordings or alleviate privacy concerns.

Update screen on events only: When enabled, Teramind will only capture the screen when mouse or keyboard activity is detected, or when a behavior rule is triggered. Otherwise, the recording remains paused on the last captured frame. In other areas, such as the Snapshots widget (which updates every 10 minutes), the system displays a random frame captured within that standard timeframe. If no activity triggered a frame capture during that period, the message “No record available” will appear.

Retention period:

Delete history after: this option is applicable to On-Premises customers only. If you specify any days in this field, the video recordings will be automatically deleted after those days. This will reduce your storage requirements and help you comply with data retention policies. Note that currently, Teramind on AWS doesn't support the removal of screen recordings from AWS S3 buckets. You can still use the Amazon S3 Lifecycle (! external link) to manage your storage.

Video quality:

Maximum frames per second (FPS): lets you specify how many frames per second will be captured. The range is 1-4, and the default frame rate is 2 frames per second.

Color and color quality of recodings: the three options, GrayScale / Color / HighColor, let you control the color of the recordings. Note that the HighColor mode is only available in On-Premises deployments and enables recording in 16-bit color compared to the default 8-bit color. It also uses the most space, and the recordings will be close to double the size of recordings without HighColor enabled.

Live screen scaling: lets you control the screen size of the recording.

Monitor keystrokes for password fields in desktop apps:

If this option is enabled, then keystrokes in the password fields will be captured for all desktop apps.

Track window titles:

This gives you the ability to toggle tracking of application titles, including document names in the titles. If you disable this option, the “Title” column on dashboards and reports like Applications & Websites will not show any data. Note that if you turn off this option, the “Applications caption” criterion in the Applications rules might not work properly for all apps.

Track console commands:

You can turn monitoring on/off for console/terminal commands using this option.

Idle time threshold (minutes)*:

You can define the to set the application idle time. It’s used in the productivity reports, Agent Schedule-based rules, and other places by Teramind.

Applications and keystrokes to monitor:

Don’t monitor private browsing:

Turn on this option to suspend monitoring for all private browsing (incognito) sessions. The browser window will be blacked out, and the keystrokes will not be captured from that window. However, the full URL is still captured in the activity log. For this reason, keystrokes might still be captured as part of the URL. For example, when you use a search engine like Google.

Monitor keystrokes for password fields in browser:

You can toggle monitoring of keystrokes in password fields. For example, a login page containing an HTML input field such as <input type="password">*. See the notes below for more information.

Websites to monitor:

Website content:

Don’t monitor websites that contain these words or terms: websites specified in this field will not be monitored if certain text/content is detected inside the loaded webpage. Keystrokes will not be recorded, and the screen will be blacked out. For example, by entering "password" in the field, you can dynamically suspend the login pages of most websites. Note that the text isn't case-sensitive.

IPs to monitor:

Monitor all IPs: This option lets you monitor all IPs. You can add exceptions by clicking the Exception button.

Monitor only selected IPs: this option works the opposite of Monitor all IPs. Click the Add button to add a list of IPs to monitor.

Invalid certificates:

Monitor these hosts with invalid certificates: click the Add button to add websites that have an invalid certificate. In some situations, this might be necessary. Because, by default, Teramind doesn't track connections to a website with a bad SSL certificate. So, for example, if your On-Premises server has a self-signed certificate, downloads from the Teramind Dashboard will not be recognized as web downloads. Adding the IP address of the server in this field will activate SSL traffic decryption so that Teramind will be able to properly parse and present the information on the Dashboard. However, this is not a recommended method, and this option should only be used as a last resort. Please see the notes below.

WSS Port:

This field lets you specify the port for web traffic redirection (Web Security Service). It’s used by the Teramind Agent's network filter driver to monitor web traffic. Generally, you don’t need to change the default port. However, in rare situations, you might need to change it. For example, if an application is using the default/same WSS port, you can assign a different port to the Agent using this field.

Track these applications:

You can select which social media applications will be tracked.

Track these actions on selected applications:

You can select which social media activities will be tracked. Such as Create comment, Edit comment, Create post, Edit post, etc.

Email content:

In the above examples, only emails (a) and (c) will be ignored from monitoring because emails (b) and (d) contain other domains (gmail.com and yahoo.com).

Email attachments:

Emails retention period:

Monitor applications:

In this field, you can specify which online meeting apps to track. Teramind supports monitoring of Zoom, RingCentral, Microsoft Teams, AirCall, Webex, etc.

Monitor these applications:

You can specify which messaging applications to track in this field.

Capture content:

You can track incoming, outgoing, or both types of messages by selecting the options under this section.

Monitoring period:

Monitor clipboard:

Click this option to turn clipboard (copy/paste operation) tracking on/off.

File types:

You can select which file extensions to track under this section, such as .txt, .docx, etc.

Custom file types:

If the files you want to track aren’t available under the File types section, you can use this field to manually enter file extensions. For example, .odm, pkg, etc.

File operations:

You can select which file operation (e.g., Copy, Rename, etc.) to track under this section.

File locations to skip:

If you don’t want certain locations (i.e., folders) to be tracked, you can specify them in this field. For example, Windows, ~/Downloads (to exclude the Download folder in Mac), etc.

File locations to skip (regex):

This field is similar to the above but lets you exclude multiple locations matching the regex pattern. For example: .*upload.*. You can also use local folders (e.g., Documents), network folders (e.g., \\corplan\Shared Drives), environmental/system variables (e.g., %APPDATA%), and wildcards (e.g., c:\user\*\appdata) in the field.

File origin:

This section lets you select which file origin (sources) to track, such as Local files, Network files, External drives, etc.

Cloud files:

This section lets you select which cloud drives to track for file uploads/downloads, such as Google Drive, OneDrive, Box, etc.

Print account credentials:

If you use a printer that requires login permissions, use the User and Password fields to specify the credentials. Otherwise, Teramind will not be able to monitor it.

Exclude printers:

In this field, you can add regular expressions to exclude any printers matching the name. For example, .*epson.

Printing capturing settings:

Retention period:

Delete history after: applicable to On-Premises customers only. If you specify any days in this field, the video recordings will be automatically deleted after those days. This will reduce your storage requirements and help you comply with data retention policies. Note that currently, Teramind on AWS doesn't support the removal of screen recordings from AWS S3 buckets. You can still use the Amazon S3 Lifecycle (! external link) to manage your storage.

Time Threshold:

By default, every time a user changes their location, it’s reported. You can specify a threshold (in seconds) to configure how often the location data will be reported instead. This can be useful in situations where the location changes too often and you don’t want your Geolocation report to be flooded with information. For example, when you are traveling on a train or in a taxi with a laptop, your location may change every minute, and the Geolocation report will show all the updates. With this setting, you can set a wait time before changing a location update.

The default value is 600 (or 10 minutes). A value of 0 will disable this option.

Monitor all input / Monitor all output:

Allows you to enable/disable recording for all input (e.g., microphones, line-in) and all output devices (e.g., speaker, line-out).

Monitor when these apps use the microphone:

This field lets you capture audio only when the microphone is used by select applications. You can use the following in the field:

Note that this option doesn't affect audio output.

Audio settings:

Automatic level adjustment: if this option is enabled, it will automatically adjust the sound levels for higher/lower tones.

Async audio upload: If the user is using a Stealth Agent, this option will force Teramind Agent to use a queue for audio recordings instead of uploading them in real time. It’s suitable for a slower network or a busy server. However, you might experience some delay between the user activity and the recording appearing on the dashboard when Async audio upload is enabled.

Bitrate: You can adjust the audio quality by choosing a bit rate. A higher value will give crisper audio but will use more CPU processing and storage.

OCR languages to process:

This option allows you to pick one or more languages to process.

Process screen start date:

Process screen records after: this option allows you to pick a starting date from which the recordings will be processed. Recordings before this date won’t be processed. This option can be useful if you didn't originally have the OCR feature enabled on your instance and activated it later.

Camera Usage doesn’t come with any additional settings except for the monitoring schedules. If the Camera Usage is turned on, you will be able to detect when employees are using their webcams and the applications that are accessing the webcam from the Camera Usage dashboard.

Offline recording’s buffer length:

This option allows you to specify how long the Teramind Agent will continue to record the screen while the user is disconnected from the internet or the Teramind server. By default, the buffer is set to 24 hours, but you can increase or decrease the time as needed. Note that you cannot enter a 0 value in the field. If you want to disable offline recording completely, turn off the Offline Recording option from a monitoring profile (Monitoring Profiles > Edit monitoring profile screen).

Offline recording’s buffer size limit:

This field is optional and can be used to limit the storage utilization by offline recordings (in megabytes). The default value of 0 means there will be no limit.

Note that if you use both the Offline recording’s buffer length and the Offline recording’s buffer size limit options, the lowest value will be prioritized. For example, if you specify a 24-hour buffer length but a 10-MB buffer size, the Agent will only capture a few minutes of screen recordings (depending on the screen resolution, number of desktops/monitors, user activity, etc.). Same way, if you specified a 999999-MB buffer size but only a 1-hour buffer length, only 1 hour’s worth of screen recordings will be captured, even though the buffer can possibly hold a much longer duration of recordings.

Track these events:

The option allows you to specify which OS states will be tracked. For example, Lock, Sleep, and Screen Saver, etc. These states are sent to any SIEM integration (syslog event) you might have. These settings do not affect the monitoring of these events.

The Registry doesn’t come with any additional settings except for the monitoring schedules.

If the Registry monitoring is turned on, you will be able to detect registry entries such as programs, keys, and values with Activity-based rules.

IP tracking:

Monitor all IPs: if this option is enabled, all IP addresses will be monitored. You can add exceptions by clicking the Exception button.

Monitor only selected IPs: this option works the opposite of the Monitor all IPs option. With this option selected, you can add IPs to monitor by using the Add button.

You can enter IP addresses (e.g., 10.2.33.1) or use Network-based Shared Lists for the above two options.

Ports tracking:

Similar to the IP tracking options above, but allows you to specify ports. For example, 443, 25, etc.

Network processes:

Network processes to track: this field allows you to specify which network processes to track. You can use process names (e.g., chrome.exe, com.apple.safari, etc.), Text-based Shared Lists, or Regular Expressions (Regex)-based Shared Lists.

Network options:

SSL: you can turn this option off to disable monitoring secure connections (i.e., HTTPS / port: 443)*.

Track network connections: this option allows you to turn network monitoring on/off*.

Keep Teredo enabled: this option applies to Windows only. If enabled, this option will prevent Teramind from disabling Teredo. It’s used for secure communication over IPv6. If you encounter any problem with IP tracking, try toggling this setting.

Monitor applications:

In this field, you can specify which LLM services you want to track. Currently, only “ChatGPT Web” is supported.