The Settings menu allows you to configure different parts of the Teramind Dashboard, Agent, Security, Alerts, etc.

Click on a tab at the top to open individual settings pages.

Some settings, such as the SMTP and Server, are only available on On-Premises/Private Cloud deployments. Some options within certain settings aren't available to all deployments either. For example, the Agent automatic update under the Agents settings is only available on Cloud deployments.

For sending notifications, delivering scheduled reports, and facilitating other communications, Teramind employs the SMTP email standard. You can specify your SMTP server configuration on this page to enable proper access for Teramind.

1. Enter the SMTP Server and Port. Consult your email server's settings or contact your email provider for the SMTP configuration.

2. Provide the Sender Email. Teramind's outgoing emails will use this address. Optionally, enable Send instance hostname. This option sends the client's hostname to the server, aiding in resolving email relay issues with services like Gmail.

3. Enter the Username and Password for the SMTP server.

4. Select an Encryption option: SSL, TLS, or None.

5. Optionally, enable Verify Server Certificate to upload a trusted CA certificate (.pem or .crt file). Disabling this option forces the system to ignore invalid certificates, useful for self-signed certificates.

6. Once you are done configuring, enter an email address under the Test your SMTP settings section and press Save changes and send test to send a test email. Note that if there are any issues with any settings (e.g., incorrect values, invalid certificate, etc.), the button will be disabled.

7. Click the Save changes button to save the changes.

On the Alerts tab, you can customize how users receive various alert emails, configure the alerting frequency, and personalize the appearance of the alert messages.

1. When the Send license overutilization daily email alert option is enabled, Teramind sends daily email alerts to specified addresses if the number of monitored users exceeds the license limit. The email looks like this:

2. Administrators and optionally, department managers receive a daily digest/snapshot report via email. This email report includes sections like Alerts, Emails, Instant Messaging, Printing, and Websites, but you can customize which sections are included:

3. The Alert emails limit field sets the threshold for grouping identical alerts into a single email digest. The system will send this specified number of individual alert emails before consolidating subsequent identical alerts into a summary email. For Cloud deployments, the range is 1-100; for On-Premises/Private Cloud deployments, it's 0-1000. Setting this value to 0 will send each alert individually. The default is 16 emails.

The Maximum daily alerts count field limits the total number of alerts logged by Teramind per alert type each day. You can also configure an alert limit at the rule level within the rule's Advanced Mode action panel (using the "Choose maximum number of saved alerts per day" option). The default is 5 alerts.

The Log alert threshold field determines the minimum time interval, in seconds, between logging alerts within the Teramind system. Setting this to 0 will log every triggered alert without any limitation. The default is 1 second.

The User notification alert threshold field applies to rules with a Warn or Block action. This threshold defines the minimum time interval, in seconds, between alerts displayed to the user. Setting it to 0 will show users every triggered alert, regardless of frequency. The default is 120 seconds.

The Rule task selection action timeout field allows you to define the timeout period (in seconds) when automatically switching tasks using the Set User's Active Task rule action. If a user changes their activity and stays in the new activity for the specified duration, the rule will be re-evaluated. If a user begins an activity and no Switch Task rules are in place, their task will automatically change to the default task (see the Default Task option under Agents settings) after the defined number of seconds. The default timeout is 300 seconds (5 minutes).

The Agent attributes to use for notifications option will allow you to choose directory attributes (e.g., from Active Directory) that will be added to the rule alert notification emails. The rule alert notification email is sent when a rule is violated that uses a Notify action. With this option, the email will include the selected attributes in addition to the usual alert details:

4. This section controls the appearance of rule alerts.

Rule actions like Warn, Block, and Lock Out User allow you to display their alert messages using an HTML template by enabling the Use HTML Template option.

Use Position on screen to specify where the alert will appear on the user's screen. The default is Center, but you can select options like Top right or Bottom left, etc. You can also specify the Width and Height of the alert box.

Enter your custom HTML code in the HTML template field to define the visual style of the alerts.

Click the Preview template button to see a preview of how the alert will look. Note that due to how rendering is performed, the preview might not always match with the actual alert displayed on the user’s screen.

Here's an example of a customized alert displayed on the user’s desktop:

Here are the Custom alert template settings used for the above example:

You can incorporate dynamic variables like %ALERT% and %DETAIL% within your HTML code. Additionally, alerts can include interactive buttons such as OK and CANCEL.

For detailed instructions on utilizing this customization feature, please refer to this article in our Knowledge Base.

Note:

If you don't use the HTML template, the alert messages will appear in a simple white box with an orange border, located in the top-right corner of the user's desktop:

An access token is a secure digital credential that acts like a temporary key, allowing a user or application to access specific resources on a server. It's temporary because you can revoke it at any time. The token carries the same access level as the user who created it. For instance, a token created by an Administrator will have full administrative privileges.

This token is used for seamless automation with the Teramind API or a third-party integration. Instead of re-authenticating for every request, the application simply uses the access token, making the process much smoother and more efficient.

The Access Tokens screen allows you to create and manage access tokens.

1. Use the first dropdown to filter the list by creators: select All tokens to view tokens created by all users. Select My tokens to see your own tokens only. Note: this option is available only if you are an Administrator.

2. Use the Roles dropdown to filter the list by account access levels such as "Administrator" "Operational Administrator," etc. Note: this option is available only if you are an Administrator.

3. Use the Search field to quickly find specific token(s).

4. Click the Generate token button to create a new access token.

5. Clicking a Go to System Log button to go to the System Log dashboard with pre-applied filter scoped to the selected token. This allows you to tack the event log related to the token.

6. Click the Edit button to change the token's name/label.

7. Click the Revoke button to permanently remove a token. Revoking a token will break any integrations that use it.

When you click the Generate token button from the Access Tokens tab, a pop-up window will open:

1. Enter a Name.

2. Click the Generate token button. The token will be generated and its value will be displayed at the top of the list:

3. Click the Copy icon to copy the token to the clipboard. Click the Close button to close the token panel.

By default, only an Administrator, Operational Administrator, and Department Manager can create an access token, and the token inherits that user's permissions.

If you need to assign an access token to a regular Employee or Infrastructure Administrator, you have two options:

Option 1: Let the user create their own token:

Create an Role access control policy and grant the user a Management Features policy with the Configure access tokens permission. This will allow them to create their own token. You can later remove the policy/permission once they’ve created the token.

Option 2: Create a token for the user:

If you prefer to create the token for the user yourself without granting them the ability to do it on their own, follow these steps:

The Authentication tab allows you to configure access to the Teramind Dashboard. Here, you can set up password policies, Single Sign-On (SSO), Active Directory LDAP authentication, the dashboard settings change confirmation method, and login IP restrictions.

1. The Auth Mode options let you choose which sign-in methods are available on the Dashboard login screen. You can enable more than one method at the same time:

2. The Two-Factor Authentication (2FA) options add a second verification step to the sign-in process:

3. The Confirmation Method option allows you to customize how changes are confirmed within the Dashboard. Certain settings modifications (e.g., deleting employees, changing a user’s password, altering an employee’s access level, creating/updating departments, etc.) require confirmation before implementation, typically appearing as a dialogue box. By default, this dialogue prompts for your password.

The Confirmation Method option lets you select your preferred authentication method for these confirmations. Only available authentication options are shown. For example, Password and 2FA Code are only shown if you have those options enabled, the LDAP option is shown if the Enable LDAP option is enabled, etc. Selecting None will bypass all confirmation prompts. If the selected method is unavailable for a user, Password will be used instead.

4. The Allowed IPs option lets you specify the IP addresses that are permitted to log in to the Dashboard. Enter one IP address per line. Users logged in from an IP address that is not on the list will be logged out. The IP restriction will be enforced for all login methods (username/password, SSO, LDAP).

This option restricts Dashboard login and usage only. It does not affect monitored agents.

5. The Password options let you set the requirements for user passwords. These options apply when Enable Password is selected in the Sign-In section:

6. The Single Sign-On (SSO) section lets you set up the SAML 2.0 integration between Teramind and your Identity Provider (IdP), such as Okta, OneLogin, or Microsoft Entra ID. This section is saved separately from the rest of the tab, using the Save button at the bottom of the section. To let users sign in with SSO, you also need to select Enable SSO in the Sign-In section.

The section includes the following options:

For step-by-step instructions, please see the How to set up the SSO (Single Sign On) authentication article.

Teramind can be integrated with Active Directory to import your users, computers, groups, attributes, and other important metadata. Teramind's integration with Active Directory is read-only. Remember, you can still monitor users who are not in the domain by simply installing an agent on their computer.

Active Directory/LDAP integration provides the following benefits:

Teramind integrates with Active Directory (AD), treating Organizational Units (OUs) as Departments. You can configure specific AD Groups and OUs to control user and computer monitoring, including enabling or disabling it. Selecting all groups and OUs will monitor all users and PCs in AD. Additionally, Teramind can import both standard and custom AD attributes. These imported LDAP groups and attributes can then be used to filter dashboards and reports.

Each configured integration appears as a row in the Active Directories list, showing its domain and LDAP server. To manage an integration:

1. Click the + Setup new integration button to create a new AD integration. For step-by-step setup instructions, see the Knowledge Base article: How to Integrate with Active Directory.

2. Click the integration's domain name to open it. Editing an integration is similar to setting up a new integration.

3. Click Next: Start Import on the integration's row to sync immediately. Use this when you don't want to wait for the next scheduled sync - for example, right after setting up or editing the integration, or after making changes in your directory (new users, moved OUs, updated attributes) that you want reflected in the Dashboard right away. The integration also re-syncs automatically on its own as per the Update interval days setting - so for routine changes you can simply let the schedule handle it. See the article: How to Integrate with Active Directory for more information.

4. Click Delete on the integration's row to delete an integration. Deleting an integration removes the integration configuration, its AD groups, attribute definitions, and group memberships. It does not remove the imported employees or computers, the departments created from synced OUs, the attribute values already synced onto employee profiles, or anyone's monitoring state - all of those remain on the Dashboard as regular, unmanaged records. If you decommission an integration, review the imported employees, computers, and departments afterwards and disable monitoring, archive, or delete them manually where needed.

The OCR tab allows you to view OCR status and set up notifications for OCR mining delay.

1. The Latest mined piece of data is for shows the date and time when the OCR engine last processed a screen image, and the Session mining delay shows the time it took for the OCR engine to analyze the last screenshot and detect text inside that image.

2. The Set mining delay threshold option lets you toggle notification for the email alert. If you enable it, a Threshold field will be shown. Enter a value (in minutes). If the Session mining delay crosses this threshold, Teramind will send an email notification. The email looks like this:

3. You can temporarily disable the notification by enabling the Disable email notifications option. Select a date until which the notification will be disabled.

4. Select internal users who will receive the email notifications.

The Agents tab allows you to configure the default settings for the Teramind Agent, including how new users are created, default task assignment, screen records management, and the auto-update feature.

1. You can assign a Default task for employees at the start of their workday. This applies when using the Stealth (hidden) Agent. For this change to take effect, the user’s computer will need to be restarted. Keep in mind that you can also change or override an employee’s default task from their profile under the Account tab.

2. Enabling the Create new users on first agent connection option will automatically create a new user account the first time the agent connects to the server, if that user doesn’t already exist. In environments with numerous accounts you don’t need to monitor, such as service accounts, you can disable this option to prevent them from cluttering the system.

3. With the Disable monitoring by default option unchecked (and if your license permits), new Agent installations will have monitoring activated by default. If you check this option, new Agents will remain unmonitored until you manually activate them via the Teramind Dashboard. You can enable or disable employee monitoring from the Employee Actions Menu.

4. With the Disable monitoring for computer by default option unchecked (and if your license permits), new computer installations will be monitored automatically. If you check this option, new computers will not be monitored until you manually activate them through the Dashboard. You can enable or disable computer monitoring from the Computer Actions Menu.

5. Enabling the Enable web login for new agents by default option allows new users to log in to the Dashboard to see their own work stats.

6. The Default action for screen records option allows you to pre-select an action in the screen record deletion confirmation window. When you attempt to delete time and screen records from areas like the Live View, Snapshots, Time Cards, Employee Details, etc. pages, a confirmation window appears. This window presents you with several options for how you want to remove the records:

7. You can optionally install the Windows Stealth Agent and Mac Agents (both Stealth and Revealed) in protected mode to make it more difficult for unauthorized users and administrators to remove them. The Password required to uninstall stealth agent field lets you set the password needed to uninstall a protected Agent. The password will be required when using the agent removal tool. If a password has already been set, the field shows Unchanged. To replace the password, enter a new one and click Save.

The Security tab allows you to view and modify security settings related to hostname, session cookies, Agent protection, and data export restrictions.

1. Enter a Hostname such as acme.co.

It’s best practice to give your Teramind server a DNS entry. This way, you can click on links in the email alerts, use your own SSL certificates, and enjoy other benefits as well.

2. This section allows you to upload your SSL keys.

Teramind strongly recommends deploying your corporate SSL certificates and configuring a dedicated DNS entry on your name server. Without valid SSL certificates, browsers will block the WebSocket connections required for live screen viewing and recording. Assigning a proper DNS entry and SSL certificate eliminates browser security warnings, ensures email alert links work seamlessly, and unlocks full system functionality.

Click Choose file button under each key to upload the appropriate keys. For example, Private Key (usually a .key file), Public Key (usually a .crt file), Intermedia Key (a concatenated list of CA certificates that validates your server certificate) and the Root CA Key. Enter Pass phrase only if the private key is encrypted. Click the Save keys button. You will be asked to validate the keys. If the certificate chain files are valid, you will see a validation successful message.

3. The Session tab allows you to control how your dashboard sessions should be handled by the browser.

4. By default, Teramind allows you to export reports and video recordings to any email address. But you can enable the Specify a domain to allow Teramind data export option to restrict the export to a certain domain.

In the Domain to allow exports field, enter the last part of an email address (the domain address including the ‘@’ symbol) to restrict export emails to that domain only. For example, @teramind.co. Note that this field checks for the end of an email address, not a strict match. Additionally, you can specify something like .teramind.co. In that case, any sub-domain of teramind.co will be included in the check. For example, [email protected] and [email protected]o – both will be allowed as valid email addresses.

The Maximum email body length field allows you to set the maximum character size for the 'Body' column of an exported email report (e.g., the Emails dashboard). For example, here's a CSV report from the Emails dashboard with the Maximum Email Body option set to 2000:

And, here's the same CSV report, but this time the Maximum Email Body is set to 50:

Note how the text in the "Body" column is stripped to 50 characters and a "…" is added at the end of the text.

This feature is useful when you have many emails with large body text. Limiting the body text will make the report process faster and reduce the file size.

The default value for this field is 2000.

The Only authorized users can download files option allows you to limit access to scheduled reports to valid Teramind users (users added on the Employees list). If you send a report to an email recipient who is not on the Teramind employees list, the email recipient will still get the automated email, but the report download link in the email will not work.

This is useful for the privacy and security of your data. For example, if a recipient of the automated report accidentally or intentionally forwards the email to someone else, the other person will not be able to access this report unless they are authorized.

The Allow department managers to see and execute report option allows you to show/hide the export option on the Dashboard Actions Menu. If disabled, this option effectively disables the export of any reports by the department managers.

By default, only Admins receive daily digest emails. Enable the Send daily snapshot emails to department managers to also send them to department managers.

When you export a screen recording from the Session Player, Teramind sends an email to the recipient you specify with a link to download the video. The Video Export Link Expiry option sets how long, in minutes, this link can be used to download the video without signing in. The maximum is 2880 minutes (2 days).

Enabling the Require a Password for Video Export Links option requires recipients to enter a password before they can download a video from a direct download link. Set the password in the Video Export Link Password field. If a password has already been set, the field shows Unchanged. To replace the password, enter a new one and click Save. The password only applies to direct download links (when Video Export Link Expiry is above 0). Sign-in links already require the recipient to sign in. Repeated failed password attempts are temporarily blocked.

5. Enabling the Agree to send diagnostic data to help us improve Teramind option allows Teramind to collect non-personal usage information, such as error logs and performance data, to improve app reliability and enhance your experience. Data is sent directly from Teramind Agents to our servers. The option is disabled by default.

The AI Features tab lets you manage Teramind's AI-powered capabilities for your deployment. A single master switch turns all AI features on or off, and the feature table shows the status of each AI feature at a glance.

1. Use the Enable AI features toggle to turn AI capabilities on or off for the entire deployment. The toggle is ON by default. When you flip it, the Status column in the feature table updates immediately so you can preview the change. Nothing is applied until you click Save.

2. The feature table lists each AI feature available on your deployment and its current status:

3. Click Save to apply your changes, or Reverse changes to discard them and restore the previous state.

The Locale tab lets you configure localization settings such as language, time, and currency for your deployment. These settings apply across the interface, emails, and reports, with English as the fallback wherever a translation is not available.

1. Select your default language from the Default Language drop-down list. To see a list of currently supported languages and any known limitations, check out the Agent Specifications article. Note: You can also change a specific employee’s language preferences from their profile, under the Account tab.

2. You can select a time zone from the Timezone drop-down list. Note: You can also apply the timezone filter at the dashboard or widget level to view reports in a specific time zone. See the Filters section for more details.

3. Use the NTP Server field (available on On-Premises/Private Cloud deployments) to set up automatic clock synchronization. If your deployment has internet access, you can use a generic server like clock.isc.org.

4. You can change the Time Format to 24-hour or 12-hour (AM/PM) format.

5. You can change the Week Start Day to Sunday or Monday.

6. You can change the default currency from the Currency drop-down list. This is useful if you use Teramind for payroll or other accounting purposes. The wages will be reported in this currency.

Teramind can be deployed as a cluster of servers to handle a large number of users. If you can see this setting on your dashboard, then it means you are on a Master node. Additional nodes (such as the OCR database and screen mining nodes) may connect and want to join this cluster. Here you can configure which nodes you want to accept into the cluster, and what their function should be.

1. Managers and administrators will be able to access the Teramind Dashboard on the Management interface port. Make sure the port is available before using it. If you change this port, you will need to specify it on the Teramind Agent download links. For example:

Note that some ports are reserved and cannot be used. See the notes below for more information.

2. If you change the value in the Load balancer port, Teramind Agent will query that port instead of the default 443 port when looking for a Teramind server to connect to. If you change it to something other than 443, you will need to use the TMROUTER Agent installation parameter. For example:

Note that some ports are reserved and cannot be used. See the notes below for more information.

3. You can enable/disable multi-node deployments with the Enable multi-node deployment option. It is necessary to keep it turned on if you have more than one Teramind server.

4. If enabled, the Allow new nodes option will allow connection of new nodes to the system. For security reasons, we recommend you turn it off after you have configured all your nodes.

5. You can toggle SSH access with the Enable SSH access option. SSH is needed for remote login and configuration of Teramind servers, especially during the deployment phase.

6. If you have set up other nodes, the Nodes section shows a table of all servers in your multi-node deployment. The total storage used across the cluster is shown above the table (e.g., 87.3 GB used of 405 GB across the cluster). Only approved nodes are counted in this total. The table includes the following columns:

Use the buttons on the right side of each row to manage the nodes:

The Login Screen tab allows you to customize the appearance of the dashboard login screen to match with your company’s branding or user preference. It also allows you to display consent agreement text to users for compliance purposes.

1. Use the Select file button under Replace logo image to replace the default Teramind logo. Suggested resolution is 190x54 pixels.

2. Use the Select file button under Replace background image to replace the default background on the login page. Suggested resolution is 190x54 pixels.

3. Click the color swatch under Login button color to select a color for the UI. You can also specify a color in HTML/Hex format.

4. The User Consent Agreement Text field can be used to show a user a consent agreement during login. The user will have to agree to the agreement before they can log in. You can use different font and styling option to format the text by using the formatting icon on top of the text field.