> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Windows Clients
> Syteca's Windows endpoint agent: record local, remote, and concurrent Windows sessions, capture screen and keystrokes, and stream events to the Application Server.
## Endpoint user activity monitoring on Windows
The **Windows Client** is the Syteca agent that runs on Windows workstations and servers to record what users actually do - screen activity, applications opened, websites visited, keystrokes (including in RDP and terminal-services sessions), files transferred, USB devices used. The data streams to the Syteca Application Server in real time, where security and HR teams replay it as video, search it, and feed it into the alerting engine.
If you've been wrestling with insider-risk visibility on Windows endpoints, this is the layer that closes the gap. It captures what SIEM, EDR, and DLP miss: the human context behind an alert - exactly who did what, on which window, at which moment.
**Use the Windows Client when you need to:**
* Record user sessions on Windows desktops, servers, RDP hosts, Citrix, and Terminal Services environments.
* Investigate insider threats with video-quality replay of what a user actually saw and did.
* Monitor multiple concurrent sessions on a single Windows Server (depending on endpoint license type).
* Capture keystrokes and screen activity to satisfy compliance audits (PCI DSS, HIPAA, SOC 2).
* Deploy at scale - silently via MSI/GPO/Intune - across thousands of Windows endpoints.
This page is the operational reference: how the Windows Client behaves, the data it sends, and how to read its status in the Management Tool. For deployment and configuration, see the dedicated pages under this section.
For installation, configuration parameters, and uninstallation, see the dedicated pages under this section.
## How a Windows Client operates
* **Starts automatically** with the computer.
* **Monitors local and remote sessions**, including multiple concurrent sessions, depending on the [endpoint license type](/docs/administration/licensing/manage-serial-key#seat-licenses-and-endpoint-licenses).
* **Records a new session every login** (and every restart). The maximum duration of one session is **24 hours** - all live sessions terminate at midnight, change from **Live** to **Finished**, and new live sessions start automatically.
* **Records all monitors** if the user has multiple displays connected.
* **Compresses monitoring data** on the Client side before sending it to the Application Server.
* **Self-heals.** If a Client ever stops working, the **EkranController** watchdog process restarts it automatically.
Windows Clients use [AES-256 encryption](/docs/administration/security/encryption) to exchange binary data with the Application Server.
## Offline behavior
If the Client loses connection to the Application Server, it temporarily stores monitoring data locally in a file named `TempWrite.dat` inside the Client installation folder. As soon as the connection is restored, the cached data is sent automatically.
The Client stops writing to the offline cache in either case:
* The cached size reaches the **offline cache limit** set during [remote installation](/docs/administration/clients/install-windows) or [installation package generation](/docs/administration/clients/windows-installation-package-parameters#advanced-options). The default is **500 MB**.
* The drive has less than **500 MB** of free space.
## Recording frequency
By default, the Windows Client records user activity at these intervals (averaged - see the note below):
| Trigger | Default frequency |
| -------------------------- | ----------------- |
| **Typing** | every 10 seconds |
| **Mouse clicking** | every 3 seconds |
| **Active window changing** | every 3 seconds |
Recording triggers influence each other, so the **average** frequency is usually lower than the defaults above. The Client never records *more* often than these values.
### Adjust the typing or mouse-clicking frequency
To change the default recording frequency, edit the Windows Registry on the Client computer at:
```text theme={"system"}
HKEY_LOCAL_MACHINE\SOFTWARE\EkranSystem\Client
```
Then modify the relevant DWORD value:
| Recording trigger | Registry value name |
| ----------------- | -------------------- |
| Typing | `SmartScrTimer` |
| Mouse clicking | `SmartScrTimerMouse` |
### Disable data compression
Compression is on by default. To disable it, add a new value at the same registry key:
| Field | Value |
| -------------- | ------------- |
| **Value type** | `DWORD` |
| **Value name** | `Compression` |
| **Value data** | `0` |
## Read the Client status
A Windows Client's status in the **Clients** page tells you whether it's up to date.
### Up-to-date Client
If [automatic update](/docs/administration/clients/update-clients) is enabled, the Client updates itself as soon as it connects to a newer Application Server. Up-to-date Clients show a **green checkmark** in the **Client Version** column.
### Not-up-to-date Client
If the **Update Client automatically** checkbox is **not** selected for a Client, it must be [updated manually](/docs/administration/clients/update-clients#update-manually). Such Clients appear with:
| Column | Indicator |
| ------------------ | ------------------------------------------------------------------------------------ |
| **Client Name** | A red up-arrow icon next to the name. |
| **Client Version** | The current version, with an orange warning triangle (instead of a green checkmark). |
Clients that aren't up to date **continue to monitor user activity and send data** to the Application Server as normal. After an update, the monitored data recorded **before** the update remains accessible.
It may not be possible to update Windows Clients of very old versions. In that case, reinstall the Client instead.
## Related
A tab-by-tab map of every setting on the Editing Client page.
Automatic and manual update procedures for any OS.
The macOS equivalent - local and remote session monitoring.
Terminal, SSH, and GUI monitoring on Linux.
Online / Offline / Disconnected Client counts.