RDP session recordings with size 1K and status Encoding Error

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

While going through the list of session recordings on the Sessions > Session Recordings page, you find recordings for RDP sessions that have size 1K and status "Encoding Error". These recordings cannot be viewed. If these were for valid RDP sessions that PAM failed to record correctly, it would be a major auditing concern.

Environment

Affects PAM release up to 4.1.6.

Cause

PAM left such recording entries behind when a user launched an RDP session, got a certificate warning and responded with "No" to decline the connection. Review of the session logs confirmed that these RDP sessions were short-lived and there was no real user activity to record.

Resolution

The problem is expected to be fixed in future releases starting with 4.1.7 and 4.2.

The session logs on the Sessions > Logs page can be used to determine when the session started and ended. If you see session recording entries of this type and have doubts about their origin, contact PAM Support for additional analysis of the PAM server logs.