Manage sessions in Password Safe Cloud

Scope of this guide

This guide shows you how to use the Sessions tab in Password Safe Cloud to monitor active sessions and review recorded sessions. You can view, lock, or terminate an active session, replay a completed session recording, and restore archived sessions for review.

Prerequisites

• You have one or both of the following roles assigned for at least one managed system:
  • Active session reviewer: Lets you view and manage active sessions.
  • Recorded session reviewer: Lets you view completed session recordings.
• Alternatively, you have an Administrator or ISA role in Password Safe.
• You can sign in to your BeyondInsight/Password Safe Cloud URL.

ℹ️

Admin sessions appear in the grid only if you have read permissions to the Admin Session Reviewer feature.

Why is this important

Reviewing privileged sessions lets you detect unauthorized or suspicious activity on managed systems in real time and after the fact. Locking or terminating an active session stops risky behavior immediately. Reviewing recordings gives you a full audit trail for compliance and incident response.

Workflow summary

Steps

Step 1: Sign in and open the Sessions tab

1. Open a browser and go to your BeyondInsight/Password Safe URL (provided in your BeyondTrust welcome email; ends in /login).
2. Sign in with your credentials.
3. From the left menu, select the Password Safe icon.
   The Password Safe home page displays.
4. Select the Sessions tab.
   The Sessions grid displays.
5. Select Active Sessions or Completed Sessions to choose the view you need.
6. Use the Protocol dropdown to filter results to RDP or SSH only, or leave it set to show all protocols.

Step 2: View and manage active sessions

ℹ️

These actions require the Active session reviewer role or an Administrator or ISA role.

To view an active session:

1. Select Active Sessions.
2. Select the ellipsis (⋯) to the right of the session you want to view.
3. Select View Session.
   The live session displays.

To lock an active session:

1. Select Active Sessions.
2. Select the ellipsis (⋯) to the right of the session.
3. Select Lock Session.
   The user sees a message that the session has been locked and is told to contact their administrator.

To terminate an active session:

1. Select Active Sessions.
2. Select the ellipsis (⋯) to the right of the session.
3. Select Terminate Session.
   The session ends. It moves from the Active Sessions grid to the Completed Sessions grid.

To terminate and cancel an active session (requestor sessions only):

1. Select Active Sessions.
2. Select the ellipsis (⋯) to the right of the session.
3. Select Terminate and Cancel Session.

ℹ️

Terminate and Cancel is available only for sessions started by requestors. It is not available for administrator-initiated sessions, ISA sessions, or Admin Sessions.

Step 3: Review a completed session recording

ℹ️

These actions require the Recorded session reviewer, Auditor, ISA, or Administrator role.

1. Select Completed Sessions.
   The Completed Sessions grid displays.
2. Select the ellipsis (⋯) to the right of the session you want to review.
3. Select View Session.
   The recorded session opens.
   • Alternatively, select View Details and then select the View Session link from the Session Details pane.
4. Select Play to start the recording.
   • Hover over the progress bar to see a time stamp at any point.
   • Select anywhere on the bar to jump to that moment in the recording.
5. To zoom in, select the settings icon to the right of the progress bar and adjust the zoom percentage. You can also switch to theater mode or fullscreen.
6. In the Events pane on the left, select any keystroke entry to jump to that moment in the recording. Use the Prev and Next buttons to step through events.
7. Select the Snapshot button to export a JPEG screenshot of the current frame. The file saves to your browser's default download folder.
8. Enter comments in the comments field and select Save Comment.
9. Check Mark as Reviewed to record that you have audited this session.
   The number of audits appears as a link above the recording. Select it to see who reviewed the session and when.

Step 4: Search sessions by keystroke

To filter the current view by a word or phrase:

1. Enter a word or phrase in the Quick filter field.
   The grid filters to show only sessions that match.

To search for sessions that contain a specific keystroke globally:

1. Select Keystroke from the Filter by dropdown.
2. Enter a word or phrase in the Keystroke field.
   The grid filters to show only sessions containing that keystroke.

Step 5: Restore an archived session

In Password Safe Cloud, sessions older than six months are automatically archived. Archived sessions cannot be played until restored.

1. Select Completed Sessions.
2. Select the ellipsis (⋯) to the right of the archived session.
3. Select Restore Session.
   The restore runs in the background.
4. When the restore is complete, follow the steps in Step 3 to view the session.

Verify the results

Verify that you can see sessions in the Active Sessions or Completed Sessions grid after signing in. Confirm that actions you take, such as locking or terminating a session are reflected immediately in the grid. For completed sessions, confirm that the recording plays and the Events pane shows keystroke entries.

Next steps

• Configure session monitoring settings - Set up concurrent session limits, session masking, keystroke logging, and enhanced session auditing.
• Admin session tab | PS Cloud - Review or manage admin sessions separately.

Related resources

• Sessions tab | PS Cloud
• Approvals tab | PS Cloud