Looking for software to record Terminal Services Sessions

I have a client who is having some problems. Some of the documents and software they use on a regular basis keeps changing unexpectedly. Specifications are being changed between approval and production with no real logic why or how.

Everything points to someone either performing their job wrongly or deliberately changing the information.

Can anyone recommend an application that will record a terminal services session for playback later on?

Ideally we would set the software up on the server to record the sessions without users knowledge to see what transpires when the jobs are changed. While the job file will show at what time it was changed there seems to be no way of recoding who made the changes.

Hopefully we can use a recording of the sessions to go back to the time stamp and see if anyone was working on the file and making the changes in error, or deliberately or rule out once and for all that human error is the cause of their problems.

 

No way to record who made the changes? It's NTFS. Use Auditing.

I assume users are logging on to terminal services sessions with individual user accounts. If not, that's the first change you need to make. Then enable NTFS Auditing on the server for the locations in question.
http://support.microsoft.com/kb/310399

It's completely transparent with only a slight performance impact. Test it out to make sure you get the kind of useful information. It logs to the Security Log in event viewer.

Additionally, you should look at some kind of groupware so you can implement change management.

 

Check www.observeit-sys.com, this software record any remote desktop or terminal session

 

My 2pence...I've been using CensorNet Desktop Surveillance for some time now and it can record terminal services and Citrix style sessions. You can then search the video by meta data such as applicaiton title, username, hostname, time, etc and then export the video snippet for evidence. Hope this helps. www.censornet.com/en/products/desktopsurveillance

Hope that helps