Configure session recording policies

You can activate system-defined recording policies or create and activate your own custom recording policies. System-defined recording policies apply a single rule to entire sessions. Custom recording policies specify which sessions are recorded.  

The active recording policy determines which sessions are recorded. Only one recording policy is active at a time.

System-defined recording policies

Session Recording provides the following system-defined recording policies:

• Do not record. The default policy. If you do not specify another policy, no sessions are recorded.

• Record only events (for everyone, with notification). This policy records only events that your event detection policy specifies. It does not record screens. Users receive recording notifications in advance.

• Record only events (for everyone, without notification). This policy records only events that your event detection policy specifies. It does not record screens. Users do not receive recording notifications.

• Record entire sessions (for everyone, with notification). This policy records entire sessions (screens and events). Users receive recording notifications in advance.

• Record entire sessions (for everyone, without notification). This policy records entire sessions (screens and events). Users do not receive recording notifications.

You can’t modify or delete the system-defined recording policies.

Create a custom recording policy

You can record sessions of specified users or groups, published applications or desktops, delivery groups or VDA machines, and Citrix Workspace app client IP addresses. A wizard within the Session Recording policy console helps you create rules. To obtain the lists of published applications or desktops and delivery groups or VDA machines, you must have the read permission as a site administrator. Configure the administrator read permission on the Delivery Controller of the site.

For each rule you create, you specify a recording action and rule criteria. The recording action applies to sessions that meet the rule criteria.

For each rule, choose one recording action:

• Enable session recording with notification. This option records entire sessions (screens and events). Users receive recording notifications in advance.

• Enable session recording without notification. This option records entire sessions (screens and events). Users do not receive recording notifications.

• Enable event only session recording with notification. This option records throughout sessions only events that your event detection policy specifies. It does not record screens. Users receive recording notifications in advance.

• Enable event only session recording without notification. This option records throughout sessions only events that your event detection policy specifies. It does not record screens. Users do not receive recording notifications.

• Disable session recording. This option means that no sessions are recorded.

  

For each rule, choose at least one of the following items to create the rule criteria:

• Users or Groups. Creates a list of users or groups to which the action of the rule applies. Session Recording allows you to use Active Directory groups and white list users.
• Published Applications or Desktop. Creates a list of published applications or desktops to which the action of the rule applies. In the Rules wizard, choose the Citrix Virtual Apps and Desktops or Citrix DaaS (formerly Citrix Virtual Apps and Desktops service) sites on which the applications or desktops are available.
• Delivery Groups or Machines. Creates a list of Delivery Groups or machines to which the action of the rule applies. In the Rules wizard, choose the location of the Delivery Groups or machines.

• IP Address or IP Range. Creates a list of IP addresses or ranges of IP addresses to which the action of the rule applies. On the Select IP Address and IP Range screen, add a valid IP address or IP range for which recording is enabled or disabled. The IP addresses mentioned here are the IP addresses of the Citrix Workspace apps.

  

Note:

The Session Recording policy console supports configuring multiple criteria within a single rule. When a rule applies, both the “AND” and the “OR” logical operators are used to compute the final action. Generally speaking, the “OR” operator is used between items within a criterion, and the “AND” operator is used between separate criteria. If the result is true, the Session Recording policy engine takes the rule’s action. Otherwise, it goes to the next rule and repeats the process.

When you create more than one rule in a recording policy, some sessions might match the criteria for more than one rule. In these cases, the rule with the highest priority is applied to the sessions.

The recording action of a rule determines its priority:

• Rules with the Do not record action have the highest priority.
• Rules with the Record with notification action have the second-to-highest priority.
• Rules with the Record without notification action have the second-to-lowest priority.
• Rules with the Enable event only session recording with notification action have the medium priority.
• Rules with the Enable event only session recording without notification action have the lowest priority.

Some sessions might not meet any rule criteria in a recording policy. For these sessions, the action of the policy fallback rule applies. The action of the fallback rule is always Do not record. You cannot modify or delete the fallback rule.

To create a custom recording policy:

1. Log on as an authorized Policy Administrator to the server where the Session Recording policy console is installed.
2. Start the Session Recording policy console and select Recording Policies in the left pane. From the menu bar, choose Add New Policy.
3. Right-click the New policy and select Add Rule.

4. In the rules wizard, select a recording option and then click Next.

   

5. Select the rule criteria - You can choose one or more rule criteria:
   Users or Groups
   Published Applications or Desktop
   Delivery Groups or Machines
   IP Address or IP Range 

   

6. Edit the rule criteria - To edit, click the underlined values. The values are underlined based on the criteria you chose in the previous step.

   Note:

   If you choose the Published Applications or Desktop underlined value, the Site Address is the IP address, a URL, or a machine name if the Controller is on a local network. The Name of Application list shows the display name.

   When choosing Published Applications or Desktop or Delivery Groups or Machines, specify the Delivery Controller for your Session Recording policy console to communicate with.

   The Session Recording policy console is the only channel to communicate with Delivery Controllers from the Citrix Cloud and on-premises environments.

   

   For example, when choosing Delivery Groups or Machines, click the corresponding hyperlink in Step 3 of the preceding screenshot and click Add to add queries to the Controller.

   

   For a description of use cases that cover the on-premises and the Citrix Cloud Delivery Controllers, see the following table:

   Use Case	Action Required
   On-Premises Delivery Controller	1. Install Broker_PowerShellSnapIn_x64.msi. 2. Clear the Citrix Cloud Controller check box.
   Citrix Cloud Delivery Controller	1. Install the Citrix DaaS Remote PowerShell SDK. 2. Validate the Citrix Cloud account credentials. 3. Select the Citrix Cloud Controller check box.
   Switch from an on-premises Delivery Controller to a Citrix Cloud Delivery Controller	1. Uninstall Broker_PowerShellSnapIn_x64.msi and restart the machine. 2. Install the Citrix DaaS Remote PowerShell SDK. 3. Validate the Citrix Cloud account credentials. 4. Select the Citrix Cloud Controller check box.
   Switch from a Citrix Cloud Delivery Controller to an on-premises Delivery Controller	1. Uninstall the Citrix DaaS Remote PowerShell SDK and restart the machine. 2. Install Broker_PowerShellSnapIn_x64.msi. 3. Clear the Citrix Cloud Controller check box.

   Validating the Citrix Cloud credentials

   To query Delivery Controllers hosted in the Citrix Cloud, manually validate your Citrix Cloud credentials on the machine where the Session Recording policy console is installed. Failure to comply can cause an error and your Session Recording policy console might not work as expected.

   To do the manual validation:

   1. Log on to the Citrix Cloud console and locate Identity and Access Management > API Access. Create an API access Secure Client for obtaining an authentication profile that can bypass the Citrix Cloud authentication prompts. Download your Secure Client, rename, and save it in a safe location. The file name is defaulted to secureclient.csv.

      

   2. Open a PowerShell session and run the following command to have the authentication profile (obtained in the preceding step) take effect.

      asnp citrix.*
      Set-XDCredentials -CustomerId “citrixdemo” -SecureClientFile “c:\temp\secureclient.csv” -ProfileType CloudAPI –StoreAs “default”
      
      <!--NeedCopy-->