Changing the Default System Settings

Help Topics

Introduction to the Settings Accessing the Settings Menu Finding Information About Your Deployment Server Updates and License Key Updating Your Teramind On-Premise Server Changing the License Key Active Directory Agent Defaults Alerts Login Screen Security Host SSL Dashboard Authentication Agent Removal Protection Outgoing Exported Data Server Management Node Configuration Approving / Removing OCR Nodes SMTP System Health Localization

 

Introduction to the Settings

Settings menu allows you to configure different parts of the Teramind Dashboard, Agent, Security, Active Directory Integration etc. Note that, most of the settings on the Settings screen are applicable to the On-Premise / Private Cloud (AWS, Azure etc.) deployments. Except for: Agent defaults, Alerts, Security and Localization; these are available on all deployment options.

 

Accessing the Settings Menu

1. Click the Gear icon near the top-right corner of the Teramind Dashboard.
2. Click Settings underneath the pop-up menu.

Finding Information About Your Deployment

1. On the Settings screen, click the About tab.
2. You will see some details for your Teramind deployment including the hardware key, license key, license entitlements (no of endpoint/terminal servers), solution and license expiration date.

Server Updates and License Key

Updating Your Teramind On-Premise Server

To update your on-premise server, download the latest server image from the Self-Hosted portal at https://www.teramind.co/portal/download. Scroll to Step 2. Download Packages.  Download the Teramind Update file (with a TMU extension) by clicking the download button. Then do the following:

1. Click the About tab on the Settings screen.
2. Click the Update Teramind link to expand it.
3. Click the Select update file button and select the TMU file you downloaded from the Self-Hosted portal.
4. Click the Update button. Depending on your deployment, Teramind will update the server in few minutes.

Changing the License Key

If for any reasons, you wanted to change the license key (i.e. you upgraded from a trial to a paid account), you can do that from the About tab.

1. On the Setting screen’s About tab, enter your license key in the LICENSE KEY field located under the About the deployment section and then click the Change button. Once done, the system will display the updated entitlements for your license key.

Active Directory

Though not mandatory, Teramind can be integrated with Active Directory to import your users, computers, groups, attributes and other important meta-data. Teramind’s integration with Active Directory is read-only. Remember, you can still monitor users that are not in the domain by simply installing an agent on their computer. Active Directory/LDAP integration will provide the following benefits:

• The ability to report based on OU’s
• The ability to filter reports with attributes
• The ability to apply rules to OU’s and/or groups
• The ability to remote install to computers based on name, or AD group membership
• The ability to use Teramind only on a specific group
• The ability to exclude a group from being monitored
• The ability to log into dashboard via domain authentication

 

From the Settings screen’s Active Directory tab, you can setup Active Directory synchronization:

1. Populate the upper set of fields as follows:

LDAP SERVER	Hostname or IP address of your domain controller, e.g. 10.55.55.200.
LDAP PORT	In most cases the default port 389 should work.
ENCRYPTION	You can use tls, ldaps or none. Note that you might need to change the LDAP PORT if you change the encryption method.
LDAP LOGIN	Enter an account, e.g. administrator. A regular domain account is required to sync data from your active directory.
LDAP PASSWORD	Password for the above mentioned account
DOMAIN NAME	Your Active Directory domain name, e.g. qa.local.
USE DOMAIN NAME REMAPPING	If enabled, allows remapping of a domain name in accordance with the rules, e.g. user@qa.com -> user@remapped.com and it is configured in DB (domain_remap_rule table)
LIMIT FETCHING	If enabled, Teramind will show additional options where you can specify OUs and groups.
- HIERARCHY	If enabled, will fetch child OUs and groups only (respect hierarchy)
- FETCH ONLY THESE OUS	Limit fetching by entered OUs (comma separated names). If left empty, Teramind will fetch all OUs.
- FETCH ONLY THESE GROUPS	Limit fetching by entered groups (comma separated names). If left empty, Teramind will fetch all groups.
REPLICATE COMPUTERS’ STATE	ON: replicate AD computer state with Teramind. AD-enabled computers will be imported as auto-monitored. AD-disabled computers will be imported as non-monitored. OFF: ignore AD computer state (old behavior, default)

2. Click the NEXT: FETCH ATTRIBUTES button to fetch the attributes.
3. As soon as fetching is done, you will be able to specify additional options for attributes according to the table below. Note: If something went wrong during the fetch process, error messages will be displayed on the message area near the bottom of the screen (see item 5 below).

 

UPDATE INTERVAL (DAYS)	Enter how often (in days) to perform active directory syncs. 0 means do not sync.
IMPORT ATTRIBUTES	Attributes can be sync'd to allow more detailed reporting and user grouping. Select the attributes you want to sync into Teramind. Default is all.
IMPORT OBJECTS FROM THESE ORGANIZATIONAL UNITS (OUS)	Import users and computes from the selected organizational units into Teramind. Default is all.
GROUP TO OU ATTRIBUTE	Groups with this attribute set to true are treated as OUs.
MONITOR USERS IN THESE GROUPS	Enable monitoring for users in these groups and disable monitoring for users not in these groups.
DON'T MONITOR USERS IN THESE GROUPS	Disable monitoring for users in these groups.
STOP MONITOR USERS THAT NO LONGER EXIST IN AD	If enabled, Teramind will automatically disable monitoring of all computers that is not in the AD or out of the synced OU.

4. Click the SAVE SETTINGS button to save the settings. Click the IMPORT button to initiate the import process. You might have to wait for a couple of minutes depending on AD object count and hierarchy. Once the import is done, refresh the page to view the changes. Note: If something went wrong during the import process, error messages will be displayed on the message area near the bottom of the screen (see item 5 below).
5. The messages area below the screen shows the task progress and any error the system might encounter.

Agent Defaults

This tab allows you to change the default settings for the Teramind Agent.

1. You can change the currency used.
2. You can assign a default task for employees when they start their shift (this is applicable if the employee is using the Hidden Agent). Restart the user machine(s) after changing the default task for it to take affect.
3. If ENABLE MONITORING FOR NEW AGENT… is turned on and your license allows it, new agent installations will have monitoring enabled by default. If disabled, new agent installations will not be monitored until you activate them from the dashboard.
4. Enable WEB LOGIN… if you want your users to be able to log into the dashboard to see their own work stats, enable this option.

Alerts

Alerts tab allows you to define how rule violation messages will be displayed to the users. It’s a good idea to customize your alert messages so that they are visually distinctive and match with you company’s branding.

1. You can use the HTML template by default for all rules.
2. You can customize the look and feel of your message box by editing the HTML in the CUSTOM USER ALERT HTML field. There are a few dynamic variables such as ALERT, DETAILS you can use in your message. In addition, the alert can have buttons like: OK, CANCEL. You can also include base64-encoded images in your HTML. This is great for displaying icons or logos.
3. You can preview how the alert will look by clicking the PREVIEW button.
4. SCREEN LOCATION defines where the alert will be displayed (i.e. Center, Top-Left etc.).
5. WIDTH changes the width of the alert box.
6. HEIGHT changes the height of the alert box.
7. ALERT EMAIL LIMIT defines the threshold where the system will group the alerts into a single email. The system will send this many identical alert emails, and then it will group them together into an email digest. If set to 0, it will send each alert individually.
8. USER ALERT THRESHOLD applies to rules with a Warn or Block action. The threshold sets the minimum time, in seconds, to wait between alerts that the user sees. If set to 0, users will see all alerts they violate, regardless of the frequency.
9. LOG ALERT THRESHOLD sets the minimum time, in seconds, to wait between logging alerts to the Teramind system. If set to 0, it will not limit the number of alerts that are logged.
10. MAXIMUM DAILY ALERTS COUNT limits the total number of alerts which get logged by Teramind on a daily basis per alert type.
11. You can build rules in Teramind to set a user’s task based on their activity. RULE TASK SELECTION ACTION TIMEOUT (SECONDS) defines the time out when switching tasks. If the user switches activity and remains in the new activity for the defined seconds, the rule will be re-evaluated.

Login Screen

You can customize the appearance of the dashboard login screen to match with your company’s branding or user preference.

1. Use a LOGO IMAGE for uploading a logo image. Suggested resolution is 190×54 pixels.
2. Use a BACKGROUND IMAGE for uploading background image. Suggested resolution is 1400×933 pixels.
3. You can also change the LOGIN BUTTON COLOR by specifying a color in HTML/Hex format.

Security

Host

It’s best practice to give your Teramind server a DNS entry. This way you can click on links in the email alerts, use your own SSL certificates, and enjoy other benefits as well.

1. Enter a hostname such as dashboard.teramind.co.

SSL

Teramind strongly recommends proper configuration of SSL in order to avoid browser warnings and restrictions. Some browsers will not allow websockets communications if the certificates are invalid. This may prevent you from watching live screens or record them.

For convenience, Teramind comes pre-shipped with an SSL certificate that’s valid for the hostname onsite.teramind.io.

If you wish to proceed without implementing your own certificates, you should add a line to your local hosts file and then access Teramind by browsing to https://onsite.teramind.io. You can do this by editing C:\Windows\System32\Drivers\Etc\hosts as Administrator and appending the following line to the file:

xxx.xxx.xxx.xxx onsite.teramind.io

Where xxx.xxx.xxx.xxx is the IP you assigned to your Teramind Virtual Machine.

In the long run, you should deploy your organization’s SSL certificates within Teramind, and add a DNS entry in your corporate name server for your Teramind implementation.

Here’s how you should setup the SSL:

1. Upload your server’s Private Key (usually a .key file), Public Key (usually a .crt file), Intermedia Key (a concatenated list of CA certificates that validates your server certificate) and the Root CA Key.
2. Click the VALIDATE KEYS button. After you’re done, please access Teramind via the new hostname. You’ll be asked to log-in again.

Dashboard Authentication

Teramind processes large volumes of confidential and private data, so it’s a best practice to lock down access to the dashboard as much as possible.

1. If you enable the FORCE USERS TO LOG IN USING 2-FACTOR AUTHENTICATION option, next time administrators log in they will be forced to enable 2FA before being given access to their dashboard. Teramind supports 2FA apps like Google Authenticator or Authy. Check out this article to learn how to set up 2FA for a user.
2. Enabling the BASIC USER/PASSWORD AUTHENTICATION option will allow you to authenticate to the dashboard using the user-password credentials you created in Teramind. Check out this article to learn how to create/change password for a user.
3. If you have successfully set up Active Directory integration, you may want to use your domain credentials to login. In such a case, you can turn on the LDAP AUTHENTICATION option. Check out the Active Directory section to learn more about AD setup.
4. SINGLE-SIGN-ON AUTHENTICATION option allows you to authenticate to the dashboard using a Single Sign On (SSO) service such as Okta, One Login etc. via SAML2 protocol. Newly generated users will still need to set password in order to make further changes to account or login using Teramind revealed agent. Enabling the SSO option will reveal several options which you can use to configure the SSO integration. You will also see an AUTO REGISTER NEW AGENT option. If enabled, this will let you specify default options for newly registered users/agents on SSO. Check out this Knowledge Base article for details on these settings and step by step instructions on setting up a SSO integration.
5. The ALLOWED IP TO LOGIN option lets you specify which IP addresses are allowed to login to the dashboard. If you use this option, only the users with allowed IPs will be given access to the dashboard.

Agent Removal Protection

You can optionally install the Teramind Hidden Agent in protected mode to make it more difficult for unauthorized users and administrators to remove it. If you do this, you should set the uninstall password so that you can remove the agent when you wish.

1. Enter a password to protect the Agent uninstallation.

Outgoing Exported Data

By default, Teramind allows you to export reports, video recordings and other data to any email address. But you can change the settings to restrict export to certain domain only.

1. Enter a domain address to restrict export emails to that domain only.

Server Management

Node Configuration

Teramind can be deployed as a cluster of servers to handle a large number of users. If you can see this setting on your dashboard, then it means you are on a Master node. Additional nodes (such as the OCR database and screen mining nodes) may connect and want to join this cluster. Here you can configure which nodes you want to accept into the cluster, and what their function should be.

1. You can enable/disable multi-node deployments with the ENABLE MULTI-NODE DEPLOYMENT toggle button. It’s necessary to keep it turned on if you have more than one Teramind servers.
2. Turn SSH access on or off with the ENABLE SSH ACCESS toggle button. SSH is needed for remote login and configuration of Teramind servers, especially, during the deployment phase.
3. Managers and administrators will be able to access the Teramind dashboard on the MANAGEMENT INTERFACE PORT. Make sure the port is available before using it.
4. Teramind Agent will query this LOAD BALANCER PORT instead of the default 443 when looking for a Teramind server to connect to. If you change it something other than 443, you will need to use the TMROUTER parameter when installing the Teramind Agent. For example:

 c:\msiexec /i teramind_agent_x64_s.msi TMROUTER=101.12.1.2:xxx /qn

Where xxxis the load balancer port.

Approving / Removing OCR Nodes

If you have setup an OCR database node or an OCR mining node, you will see the nodes displayed under the Nodes section on the Server Management tab. Please consult the relevant deployment guide to learn how to setup the OCR nodes. You can find the deployment guides on the Knowledge Base’s home screen.

1. Click the REMOVE button to cancel approval (un-approve) for a previously approved node.
2. Click the FORGET button to completely delete a node. For example, if you deleted a Virtual Machine used by an OCR node, you can delete the node from here.
3. Click the APPROVE button to approve any pending node connection requests.

OCR Ports for On-Premise Deployments:
Please make sure the following ports are enabled and open among all nodes (master, OCR database, OCR mining):443, 5432, 9200 and 42001.

SMTP

Teramind uses the SMTP email standard to send notifications, deliver scheduled reports and other communications purposes. You can specify your SMTP server configuration here so that Teramind can access it properly.

1. Provide details for the server, encryption, port, username, email and password. Consult your email server’s settings for the SMTP configuration or contact your email provider.
2. Click the SAVE button.
3. Test your settings by having Teramind attempt to send you an email using the configuration you specified.

System Health

System Health tab gives you a quick snapshot of the current status of the server load, storage condition and session mining (OCR process) status.

1. The System load section shows the TOTAL NUMBER OF CORES the CPU has, 5-MINUTE LOAD AVERAGE (%) and MEMORY USAGE status.
2. The Storage section shows the PRIMARY VOLUME USAGE and the RECORDING VOLUME USAGE information. Primary volume typically contains the Teramind database and the recording volume contains the screen recordings. You can always adjust your usage by tweaking your screen recording settings and retention policies. Check out the Editing Screen Settings section to learn more. You can also use MINIMUM SPACE THRESHOLD setting to tell Teramind to stop recording when reaching this minimum space threshold (in MB).
3. The Session mining stats shows the OCR processing status. ISM DELTA = number of records not processed yet, ISM DAY DELTA = number of days not processed yet; and the ISM SCORE = overall performance of the session mining process.

Localization

Localization tab allows you to change the time and language settings.

1. You can change the TIMEZONE you want to use.
2. Use the NTP SERVER to specify a time server. Teramind will automatically sync the clock with the server. You can select a generic server like clock.isc.org if your deployment has internet connectivity. Note that, for the best result make sure all your monitored endpoints and the Teramind server are on the same NTP. Otherwise, you may see discrepancy between the time an activity happened vs. the time it’s recorded in Teramind. Note that, this option is not available on Cloud deployments.
3. You can change the DEFAULT LANGUAGE used by the system. Teramind supports English, Spanish, Japanese, Portuguese, Russian and Turkish. Note that, you can change the language for an employee/user from their Profile page.