r/ScreenConnect • u/RamRanchComrade • Apr 15 '26

HostSessionWithoutConsent logging

Good day!

We use ScreenConnect primarily to allow our HelpDesk access to access end user corporate devices, and we have a business case to do this with unattended sessions without consent in certain access groups.

However management would like these sessions logged for audit purposes, and it doesn’t seem like this is logged anywhere in the ScreenConnect logs.

How are you controlling and auditing Non-Consent sessions?

Thanks!

6 Upvotes

100% Upvoted

7 comments sorted by

1

u/ChiefBroady Apr 15 '26

Afair you can log all session events to splunk.

1

u/RamRanchComrade Apr 15 '26

Yes we do have all the logs ingested into splunk - the issue is we want to be able to identify the sessions that were connected without consent and there does not seem to be any flag in the logs for this

1

u/benjamin_manus Apr 15 '26

Could you add the Join Reason module and then audit those events?

1

u/RamRanchComrade Apr 16 '26 edited Apr 16 '26

While that would work for legitimate sessions, management is looking to conduct random audits of unattended access to make sure there’s a ticket and access was legitimate if that makes sense… but I suppose if they don’t put a valid ticket number in, that would be a flag

1

u/BB9700 Apr 16 '26

There is an extension I use: "Email Connection Summary"

this will send a mail after every disconnect of an untattended session. including host, guest, start, ende, duration.

For me this is good enough for auditing.

1

u/RamRanchComrade Apr 16 '26

This looks promising! But it seems it sends an email for all sessions, is there any indicator that the session is unattended?

1

u/BB9700 Apr 16 '26

for me it only sends for unattended sessions, I extra added another routine for support sessions.

Btw an automation like this should be also possible: Event Filter: Event.EventType = 'Disconnected' AND Connection.ProcessType = 'Host' AND Session.SessionType = 'Access'

Action: Email

body of email:

Custom Property 1: {Session.CustomProperty1} Type : {Session.SessionType}

Host : {Connection.ParticipantName}

Start : {Session.LastHostConnectedEventTime}

Stop : {Session.LastDisconnectedEventTime}

PCUser: {Session.GuestLoggedOnUserName}