Skip to main content

Request SaaS Deployment

Contact Sales

Employee Monitoring

How to Install Ekran System Windows Clients Remotely and View User Sessions 


Monitoring user activity is crucial for maintaining a secure IT environment and complying with cybersecurity regulations. Ekran System is a comprehensive human-focused insider risk management platform for monitoring and managing user sessions. The platform lets you view user sessions to analyze employee and third party activity, meet compliance requirements, and protect your data and critical systems from insider threats.

This article will walk you through the process of installing Ekran System Сlients (i.e. our software agent) on Windows endpoints and viewing user sessions. By following this guide, you’ll learn how to:

  • install Ekran System Сlients on Windows endpoints remotely 
  • filter user sessions by various parameters
  • view user sessions 
  • search for specific user activity within sessions.

Why view user sessions? 

Poorly supervised users pose security risks to organizations of all sizes. According to the 2024 Data Breach Investigation Report by Verizon, 68% of all data breaches include a human element. Intentionally or unintentionally, employees may leak your sensitive data, resulting in cybersecurity incidents. To mitigate human-related risks, you need to ensure full visibility into user activity within your IT environment. 

Monitoring user sessions with Ekran System provides the following benefits for organizations:

Why monitor user sessions?

Enhance visibility. By monitoring user sessions, you can view user activity within your network. You can also review user session recordings to determine when, how, and by whom your critical systems and data were accessed.

Secure data from insider threats. By monitoring and analyzing session data, you can identify unusual user activities that may indicate unauthorized access, data exfiltration, system sabotage, etc. You can also oversee how well your employees follow your security policies regarding prohibited websites and unauthorized software use.

Ensure fast incident response. You can detect suspicious user activity in real time and take immediate measures to curtail threats before they cause significant damage to your organization. 

Streamline incident investigation. When you view and record user sessions with Ekran System, you can further export those recordings for forensic analysis during incident investigations. User session recording functionality can also help you identify the root cause and detect vulnerabilities in your systems that have facilitated malicious activity. 

Comply with cybersecurity laws and regulations. Many cybersecurity laws, standards, and regulations such as ISO 27001, SOX, HIPAA, and PCI DSS require organizations to monitor user activity on their critical endpoints. An effective monitoring solution can help you meet these and some other compliance requirements

Analyze employee productivity. Viewing user sessions provides valuable insights into employee performance. Based on these insights, you can optimize workflow to enhance employee productivity.

Monitoring user activity is critical for organizations of all sizes that deal with sensitive data. Let’s take a look at the monitoring features Ekran System offers. 

What insights do you get by monitoring user activity with Ekran System?

Ekran System is a full-cycle insider risk management platform that offers comprehensive session viewing and recording capabilities. The platform allows you to monitor user activity, manage access to endpoints, detect insider threats and respond to them, and generate detailed reports

Ekran System lets you view live user sessions or play back recorded ones in an intuitive session player. Ekran System records user activity in a screen-capture format with indexed metadata:

  • Launched applications
  • Visited URLs
  • File upload operations
  • Clipboard operations
  • Executed commands (Linux)
  • Keystrokes
  • Connected USB devices
  • Active vs. idle time.

To ensure the confidentiality and integrity of the monitored data, Windows Clients use AES-256 encryption when sending the data to the Ekran System Server and storing it in the database.

Why Ekran System

As for productivity metrics, you can view intuitive dashboards showing you the following stats:

  • Total active vs. idle time 
  • Top applications used
  • Top websites used
  • Overall user productivity.

We invite you to explore how to install Windows Clients remotely and start monitoring user sessions.

If you prefer a visual guide, you may watch our YouTube demo:

How to install Windows Clients remotely

To ensure successful remote installation of Windows Clients, you need to set up your network environment beforehand. The main requirements include the following: 

  • The remote computer must be connected to the network.
  • Shared folders on the remote computer must be available.
  • Administrator credentials for the domain or local system are required.
  • Both the Server service and the Remote Procedure Call (RPC) service need to be operational on the remote computer.
  • Specific ports must be opened in Windows Firewall to guarantee the stable operation of Ekran System.

Once you’ve met these requirements, you can start installing Ekran System Windows Clients via the Management Tool. 

To choose computers for the Client installation:

1. Log in to the Management Tool.

2. Open the Client Management page.

3. Click the Install Clients button in the top right.

Client management

Choose how you want to search for the computer(s) where you want to install the Windows Client. You can specify an IP range or computer name. 

Deployment options

If you know the computer’s name, the quickest method is to choose the Deploy on specific computers option and enter the name or IP address of the computer in the Name field that appears. Type the full name of the computer in the corresponding field and then click Scan. If you need to install Clients on multiple computers, separate the names of computers by semicolons.

Note: this option only works if you know the name of the computers that you want to deploy the agent on. For guidelines on using other options, refer to our documentation

Enter the computer name

When the scanning process is complete, you’ll see the list of computers on which you can install the Client. Select the checkboxes next to the computers you want to install Clients on and click Next.


The selected computers will be added to the list on the Computers Without Clients page. On this page, click the Install button.


Note: newly installed Windows Clients have custom monitoring configurations that can be individually modified for each Client.  

In addition to the remote Windows client installation method mentioned above, there are other ways to install Windows Clients on your endpoints.

Ekran System also allows for the Windows Client installation via other methods: 
Installing Windows Clients locally
Installing Windows Clients through group policy using an MSI file
Installing Windows Clients using third-party software
Installing Windows Clients on Amazon WorkSpaces
Installing Windows Clients remotely using PsExec

Note that Ekran System supports other operating systems and Clients can also be installed on macOS and Linux endpoints.

How to view user sessions

Ekran System records user activity in the screen capture format accompanied by indexed metadata. To view user sessions, click on the Monitoring Results navigation link on the left.

Monitoring results

You will see a list of monitored user sessions. If any alerts have been triggered during a specific session, you’ll see a corresponding Alert icon in that list item:

stands for a normal risk level

warns about a high risk level

indicates a critical risk level

By default, filters for Who, When, and Where are displayed. However, if you need to search by more specific parameters, you can use other filters by clicking on the More Criteria button.

For example, if you want to view sessions performed on a specific computer, сlick on the Where field and select the endpoint from the list.

Choosing a computer

You’ll see the list of all sessions performed on this endpoint. 

Choose the session you want to view and double-click it. Depending on your browser configuration, the session will open in a new tab or a new window.

Session playing

The Session Player displays screen capture recordings of the selected computer on the left side and metadata grid on the right side. You’ll see columns for the following information:

Activity time

The time when the activity was recorded

Activity title

The names of the active windows associated with the recorded activity

Application name

The names of all applications opened on the endpoint during the session


The domain names of visited URLs

Text data

Keystrokes, clipboard operations, and file uploads

Alert/USB rule

The name of the alert or USB rule triggered, if any

If a session record contains keystrokes, clipboard operations, or file upload operations, you can double-click on these activities to view detailed information in the Details area below the Session Player.

Details section

In the Search box at the top of the list, you can enter a keyword or a part of it to find the activity you need. Search for a specific user activity by the aforementioned parameters, such as URLs, application names, keystrokes, and others.

For example, you can type “tor” to see what actions the user performed regarding activities in the Tor browser.

Search for keywords

This allows you to track all user actions, from the initial search for information about the Tor browser to its installation on the computer.

Search results

Installing unauthorized apps, using cloud storage services, or connecting unapproved USB devices may lead to negative consequences, such as data compromise. With Ekran System’s User Activity  Monitoring, you can determine whether any of your employees are neglecting your information security policies and putting your organization’s sensitive assets at risk.

Ekran System also has a comprehensive alerting system, allowing you to get notifications about suspicious user activity. You can set custom alerts tailored to your specific needs or use preset ones. 

In addition to user activity monitoring and alerting, Ekran System provides incident response features, auditing and reporting, and access management capabilities to help you implement a holistic approach to securing your IT infrastructure.

Case study

Maman Group Enhances Visibility into Activity of Employees, Vendors, and Subcontractors with Ekran System


Monitoring user activity is essential for maintaining a secure IT environment within your organization and complying with relevant cybersecurity regulations. Ekran System stands out for its simple setup and robust monitoring features. 

Ekran System allows for quick installation of Windows Clients remotely and viewing user sessions with ease. Experience the benefits of Ekran System and elevate your security!

Request a free 30-day trial of Ekran System

and test its capabilities in your IT infrastructure!



See how Ekran System can enhance your data protection from insider risks.