---
title: "Record remote sessions"
description: "Turn on recording of remote desktop sessions on Enterprise and MSP, choose which endpoints, play recordings back, and know where they are kept and for how long."
url: "https://support.outpostplatform.com/remote-access/session-recording/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Session recording on Enterprise and MSP. remote_access.recording_required is off by default; a profile turns it on and any profile requiring it wins. recording_pauses_on_idle stops it while paused. Play back from Remote > History with remote:view_recordings. Encrypted per recording, kept 30 days. No framework baseline requires it."
availability:
  plans: ["enterprise", "msp"]
  permission: "remote:view_recordings"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/remote-access/session-recording.mdx"
license: "CC BY 4.0"
---

# Record remote sessions

Session recording keeps a video of what a technician saw and did on an
endpoint's screen, so you can review a session later or hand it to an auditor.
Recording is off until a profile turns it on. This page shows how to turn it
on, how to play a recording back, and where recordings are kept.

## What is recorded

A recording is the endpoint's screen as it was sent to the technician, from the
moment video starts until the session ends. It is captured by your Outpost as
the video passes through, so the endpoint uploads nothing extra.

- A recording holds video only. It does not hold clipboard or file content,
  which your Outpost cannot read. Transfers appear in the audit log instead.
  See [Clipboard and file transfer](/remote-access/clipboard-and-file-transfer/).
- When the signed-in user at the endpoint changes during a session, each user's
  part is a separate history row with its own recording.
- When a session pauses for technician inactivity, the recording stops and
  another part starts when the session resumes, unless
  `remote_access.recording_pauses_on_idle` is off.

## Before you begin

- Recording is included in Enterprise and MSP. On Home Lab and Essentials,
  sessions are not recorded, `remote_access.recording_required` is hidden in
  the profile editor, and a profile that requires recording cannot be
  applied. A profile that required recording before a
  change of plan keeps working, and the viewer warns that the session is not
  being recorded. See
  [Plan feature reference](/reference/plan-features/#session-recording).
- Playing a recording back needs the `remote:view_recordings` permission.
  Changing whether sessions are recorded needs `profile:manage`.
- Recordings go to your default storage destination. Without one, they stay
  on your Outpost's own disk. See [Storage destinations](/depot/storage/).

## Choose which sessions are recorded

`remote_access.recording_required` decides whether sessions on an endpoint are
recorded. It is off by default on every plan, so no session is recorded until a
profile turns it on. When profiles disagree, any profile that requires
recording wins.

To record sessions on some endpoints:

1. Go to **Profiles** > **All profiles**, and open a profile assigned to those
   endpoints. To record every session, use a profile assigned to all of them.
   See [Create and assign a profile](/automation/create-a-profile/).
2. On the **Settings** tab, in **Search settings**, enter
   `remote_access.recording_required`.
3. Select **Set in this profile**, turn the value on, and select **Save**.

No compliance framework baseline requires recording, so assigning a framework
does not turn it on. Turn it on where your own policy or your auditor asks for
recorded sessions. See
[Compliance framework baselines](/compliance/framework-baselines/).

To record the idle part of a paused session too, turn
`remote_access.recording_pauses_on_idle` off in the same way. It is on by
default, so an hour of a paused screen is not stored.

## Play back a recording

1. Open the endpoint, and select **Remote** > **History**.
2. In the **Recording** column of the session, select **View**. A dash means
   that session part has no recording.

   The recording opens in its own window, titled **Session recording**, with
   your browser's own video controls.

When a paused session produced more than one part, **View** opens the first
part. Seeking backwards past what has already downloaded starts the download
again.

If the window says **This recording could not be played.**, either the
recording holds no video, for example a session that never showed a picture, or
your role lacks `remote:view_recordings`.

## Where recordings are kept

Each recording is encrypted with AES-256-GCM under a key of its own, and that
key is in turn encrypted with your organization's key. Your Outpost writes the
recording to its own disk while the session runs, then moves it to your
default storage destination when the session ends. With no default
destination, the recording stays on your Outpost's disk. On the MSP plan, each
client's recordings go to that client's default destination, or to the
practice's fallback destination when the client has none.

If the move fails, for example because the destination is full or its quota
would be exceeded, the recording stays on your Outpost's disk and still plays
back. Recordings in Outpost Cloud Storage count toward your storage usage.

## How long recordings are kept

Each recording is kept for 30 days after its session ends, then deleted. Your
Outpost checks for expired recordings every hour.

If your plan changes and no longer includes recording, recordings you already
have stay playable until they expire.

## Verify

1. Start a short session on an endpoint in the profile's scope, then select
   **End**.
2. Open **Remote** > **History**. The session's row shows **View** in the
   **Recording** column.
3. Select **View**, and check that the recording plays.

## Related

- [Remote access](/remote-access/)
- [Remote access policy settings](/remote-access/policy-settings/)
- [Storage destinations](/depot/storage/)
- [Plan-locked features](/depot/plan-locked-features/)