All Products
Search

This Product

    Elastic Desktop Service:View or download session recordings

    Document Center

    Elastic Desktop Service:View or download session recordings

    Last Updated:Jun 11, 2026

    The screen recording audit feature records end user activity on cloud computers. Administrators can review these recordings for operational audits, providing a reliable basis for security reviews. This topic describes how to view or download session recordings.

    Background

    The policy associated with a cloud computer determines whether user sessions are automatically recorded. For more information, see Audit-related rules.

    If the screen recording audit feature is enabled in the policy and the cloud computer's image supports this feature, the system automatically records user sessions based on the configured recording type. The system continuously uploads the recordings to an OSS bucket.

    Before you view or download session recordings, note the following:

    • Ensure that your Resource Access Management (RAM) user has permission to configure screen recording audit policies. For more information, see Grant permissions to a RAM user.

    • Session recordings are associated only with the policy that has screen recording audit enabled.

    • During upload, the system splits recordings into 32 MB files. If a recording is smaller than 32 MB, the system continues to write to the file locally until the end user disconnects from the cloud computer.

    Procedure

    Session recordings are automatically saved to an OSS bucket. You can use one of the following methods to view or download the recordings.

    1. Log on to the EDS enterprise console.

    2. In the top navigation bar, select a region.

    3. Perform one of the following operations based on which recordings you want to view:

      Specific cloud computer

      1. In the left-side navigation pane, choose Resource Management > Cloud Computers.

      2. On the Cloud Computer Enterprise Edition page, find the target cloud computer, click the More icon in the Actions column, and select Recording Playback.

      Specific computer pool

      1. In the left-side navigation pane, choose Resource Management > Shared Cloud Computer.

      2. On the Shared Cloud Computer page, on the Many-to-Many tab, find the target computer pool and click its computer pool ID.

      3. Select the Cloud Computer tab and find the target cloud computer. In the Actions column, click the More icon and select Recording Playback.

      All recordings

      1. In the left-side navigation pane, choose Security & Audits > Screen Recording.

      2. You can filter recordings by cloud computer ID, username, or time.

    4. In the Actions column for the target recording, click Play Back or Download.

      Note

      When you click Play Back, the recording opens in a player window. The player supports standard controls, including a draggable progress bar, full-screen mode, picture-in-picture mode, and playback speed adjustment.

    FAQ

    Why are session recordings missing?

    Troubleshoot the issue as follows:

    • Verify that the cloud computer meets the following prerequisites:

      • They use the Adaptive Streaming Protocol (ASP). For more information, see Adaptive Streaming Protocol (ASP).

      • They run a Windows or Linux operating system.

      • They use a system image of version 0.1.0 or later, or a custom image created from such an image.

    • Confirm that an end user has connected to and used the cloud computer.

    Are session recordings automatically deleted?

    • The system stores session recordings in the OSS bucket for the retention period that you configured when you enabled the screen recording audit feature. The system automatically deletes the recordings after the retention period expires.

    • If you unassign a policy with screen recording audit enabled from a cloud computer and then delete the policy, the system does not immediately delete the recordings generated under that policy. The system retains these recordings until the configured retention period expires and then automatically deletes them.