Audit page
Introduction
The Audit page allows an administrator to view session activity, such as host and guest connections, during a specific time and date range. There are two types of auditing: basic and extended.
Note: Check your database maintenance plan to see how often data and extended auditing videos are deleted.
Basic auditing
A basic auditing query will generate a report on all sessions from a specified time range. 
Extended auditing
An extended auditing query will return the same information as a basic auditing query. You can also include a link to download session video recordings if you opt to Include Session Captures. These recordings are stored on the ScreenConnect server.
When extended auditing has been enabled, you can download a recording by clicking the Download Video link for a particular session.
Note: Extended auditing is available for select cloud packages.
Filter an audit log by session name
In both Basic and Extended Auditing, you can view connections and events for a single session by typing in the Session Name field.
Filter an audit log to include session capture
In Extended Auditing, you can include session recordings by selecting Include Session Captures.
Filter audit log by session event
In both Basic and Extended Auditing, you can select a specific event to view in the audit log. As you're building your audit request, select from the Session Event Type drop-down menu.
Tip: See our session events reference for descriptions of each session event.
Filter audit log by security event
In both Basic and Extended Auditing, you can select a specific security event to view in the audit log. As you're building your audit request, select from the Security Event Type drop-down menu.
The events are:
- LoginAttempt
- LogoutAttempt
- ChangePasswordAttempt
- ResetPasswordAttempt
The results of these events can include:
- Success
- ChangeablePasswordExpired
- UnchangeablePasswordExpired
- OneTimePasswordRequired
- OneTimePasswordInvalid
- OneTimePasswordProviderInvalid
- OneTimePasswordUserKeyInvalid
- UserNameInvalid
- PasswordInvalid
- LockedOut
