Recording External Storage Configuration

Using the Monitoring Console

FAQ

Desktop and audio recordings can be stored locally or uploaded directly by each agent to a named external storage profile. Configure profiles under File / Configuration / Recording External Storage.

Encryption is independent of the storage location and also protects locally stored recordings. See End-to-End Recording Encryption.

ChromeOS (Chromebook) Support

ChromeOS agents do not keep desktop recordings locally on the Chromebook. They upload recordings directly to external storage and support only these profile types:

  • Amazon S3 and compatible S3 services
  • Google Cloud Storage
  • Azure Blob Storage
  • WebDAV

SMB 2/3, SMB 1.0, FTP, and SFTP profiles cannot be used for ChromeOS recordings. The selected storage endpoint must be directly reachable from the Chromebook. See ChromeOS and Chromebook Employee Monitoring.

Common Profile Fields

  • Provider: select the protocol or storage service.
  • Profile name: keep the suggested name or enter a unique descriptive name.
  • Folder: optional except for SFTP. Do not add the agent name or recording-type folders; the application adds them.
  • Recording quota: zero means Unlimited. Choose whether exceeding a configured quota stops recording or deletes the oldest recordings.

SMB 2/3

  1. Create an SMB share and dedicated account on the NAS or file server. Grant list, create, read, write, and delete permission.
  2. SMB server: enter the DNS name or IP address without \\, the share name, or a mapped-drive letter.
  3. Share: enter only the SMB share name.
  4. User name / Password: enter the dedicated account supplied by the NAS or server administrator.
  5. Domain: enter the Active Directory/NT domain for a domain account. Leave it empty for a local server or NAS account.
  6. Folder: optionally enter a relative folder below the share.

The agent connects with SMB2/SMB3 protocol client.

Use a Windows Shared Folder

  1. On the Windows computer that will store recordings, create a folder such as D:\Recordings.
  2. Create a dedicated local or domain Windows account with a strong password. Do not use guest access.
  3. Right-click the folder and open Properties / Sharing / Advanced Sharing.
  4. Select Share this folder, enter a name such as Recordings, and open Permissions.
  5. Add the dedicated account and allow Change and Read. Remove broad access that is not needed.
  6. On the Security tab, add the same account and allow Modify. Share and NTFS permissions must both allow access.
  7. For a trusted network, use the Private Windows network profile and enable Network discovery and File and printer sharing under Settings / Network & internet / Advanced network settings / Advanced sharing settings.
  8. Enable the Windows Firewall File and Printer Sharing (SMB-In) rule for the trusted profile. Agents must reach TCP port 445.
  9. Set SMB server to the Windows computer name or IP address and Share to the Advanced Sharing name.
  10. For Active Directory, enter the AD domain. For a local account, normally leave Domain empty; if authentication requires it, use the Windows computer name as the domain.
  11. Run Test connection. If it fails, verify both permission sets and test \\server\share from another computer using the same account.

Modern Windows uses SMB 2/3 for this setup; do not enable SMB 1.0. See Microsoft's Windows network file-sharing guide.

SMB 1.0

Security warning: SMB 1.0 is obsolete and unsafe. Use it only with an isolated legacy system that cannot support SMB 2/3.

Fill the same fields and grant the same permissions as for SMB 2/3. SMB 1.0 must already be enabled on the server; Net Monitor for Employees Pro does not install or enable it.

FTP

Security warning: FTP sends credentials and recordings without encryption. Prefer SFTP or WebDAV over HTTPS.

  1. Ask the server or hosting administrator for an FTP account with list, create-directory, upload, download, and delete permission.
  2. FTP server: enter a DNS name or IP address. An ftp:// URL is also accepted.
  3. Port: keep the default port 21 or enter the port supplied by the FTP administrator.
  4. User name / Password: enter the credentials from the FTP server or hosting control panel.
  5. Folder: optionally enter a folder below the login directory. Start with / for an absolute path when the server permits it.

The server firewall must allow passive FTP data connections.

WebDAV

  1. Obtain an account and the URL of an existing WebDAV collection from the provider or administrator. A typical Nextcloud URL is https://server.example.com/remote.php/dav/files/user.
  2. WebDAV URL: enter the full HTTPS collection URL.
  3. User name / Password: enter the WebDAV credentials. Use an application password when multifactor authentication is enabled and the provider supports one.
  4. Folder: optionally enter a folder below that URL.

The account must permit PROPFIND, MKCOL, PUT, GET, and DELETE. The base collection must already exist.

SFTP

  1. Ask the SSH/SFTP administrator for the server, port, account, writable folder, and allowed authentication method. The server must allow SFTP and either password or public-key authentication.
  2. SSH server: enter the host name or IP address.
  3. Port: keep the default port 22 or enter the port supplied by the SSH/SFTP administrator.
  4. Folder: enter a path relative to the account's login directory, such as recordings. Start with / for an absolute POSIX path when permitted.
  5. User name: enter the SFTP account.
  6. For password authentication, leave Private key empty and enter the account Password.
  7. For public-key authentication, install the matching public key in the account's authorized_keys file, click Load..., and select the OpenSSH or PEM private key. Enter the key passphrase if it is encrypted. Click Clear to use password authentication again.
  8. Click Get key..., compare the SHA-256 fingerprint with the server administrator's fingerprint, and confirm only if they match.

The private-key contents, not the console-local file name, are saved in the profile for use by the agent. Protect the profile and use a dedicated passphrase-protected key where possible. The account needs list, create, read, write, and delete permission.

The client private key authenticates the account; the separate server host key identifies the server. Omitting the host key disables server identity verification and is unsafe.

Amazon S3

Use a dedicated Amazon S3 general-purpose bucket and IAM user. Never use root-account credentials or make the bucket public.

1. Create the bucket

  1. Sign in to the AWS Management Console with an administrator identity and open Amazon S3.
  2. Select the AWS Region where recordings should be stored, such as eu-central-1.
  3. Open Buckets / Create bucket and keep General purpose as the bucket type.
  4. Enter a globally unique lowercase name, such as organization-recordings-12345, and save the exact name.
  5. Keep Object Ownership set to Bucket owner enforced and keep all Block Public Access options enabled.
  6. For predictable quota cleanup, leave Bucket Versioning disabled. If it is required, add a Lifecycle rule to expire noncurrent versions. Default SSE-S3 encryption needs no extra permission; a customer-managed KMS key does. Do not enable Object Lock if the application must delete recordings.
  7. Create the bucket and save its exact AWS Region code from the Properties page or bucket list.

2. Create the IAM policy

  1. Open IAM / Policies / Create policy and select the JSON editor.
  2. Paste the policy below and replace both occurrences of YOUR_BUCKET_NAME with the exact bucket name.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListRecordings",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME"
    },
    {
      "Sid": "ManageRecordings",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
    }
  ]
}
  1. Click Next, resolve validation errors, name the policy RecordingStorageS3, and create it.

The policy permits only listing the selected bucket and uploading, downloading, playing, and deleting objects in it.

3. Create the IAM user and access key

  1. Open IAM / Users / Create user, enter recording-storage-agent, and create the user without console access.
  2. Open the user, select Permissions / Add permissions / Attach policies directly, select RecordingStorageS3, and add it.
  3. Open Security credentials / Access keys / Create access key.
  4. Choose an application running outside AWS, or Other if shown, continue, and create the key.
  5. Copy the Access key ID and Secret access key, or download the CSV. AWS displays the secret only once.

4. Fill the application fields

  1. Open File / Configuration / Recording External Storage, click New, and select S3-compatible storage (including Amazon S3).
  2. Profile name: enter a unique name such as Amazon S3 Recordings.
  3. HTTPS endpoint: leave empty for Amazon S3.
  4. Bucket: enter the exact bucket name.
  5. Folder: optionally enter an object-key prefix such as recordings. Do not include the bucket or computer name; the folder is created automatically.
  6. Region: enter the exact Region code, such as eu-central-1.
  7. Access key / Secret key: paste the matching IAM key values.
  8. Click Save and Test connection.

Troubleshooting

  • AccessDenied (403): confirm the policy is attached, the bucket ARNs are exact, and no bucket policy, permissions boundary, or organization policy denies access.
  • Wrong Region or AuthorizationHeaderMalformed: correct the Region code.
  • SignatureDoesNotMatch: re-enter the matching key pair and correct the agent computer's clock.
  • NoSuchBucket (404): correct the bucket name or AWS account.
  • KMS error: use default SSE-S3 or grant the IAM user the required KMS-key permissions.

AWS: Create a bucket · AWS: Create a policy · AWS: Create a user · AWS: Create an access key

How to Use S3-Compatible Services

The following services work through S3-compatible storage (including Amazon S3). Create the bucket and credentials in the provider's portal first. Enter the HTTPS base endpoint without the bucket name or a trailing bucket path; enter that name separately in Bucket. The credentials must permit listing the bucket and creating, reading, and deleting its objects. Folder is optional.

After filling a profile, click Save and Test connection. These integrations require path-style bucket URLs, AWS Signature Version 4, and S3-compatible XML listing responses.

How to Use Cloudflare R2 as External Storage

  1. Sign in to the Cloudflare dashboard, open Storage & databases / R2 / Overview, click Create bucket, and save the exact bucket name.
  2. On the R2 Overview page, open Manage R2 API Tokens and create an Account API token. Grant Object Read & Write and, for least privilege, restrict the token to the recording bucket.
  3. Copy the Access Key ID, Secret Access Key, and S3 endpoint while they are displayed. Store the secret securely.
  4. Create an S3-compatible profile. Set HTTPS endpoint to https://<ACCOUNT_ID>.r2.cloudflarestorage.com, Bucket to the bucket name, and Region to auto.
  5. Enter the R2 Access Key ID and Secret Access Key, optionally set Folder, then save and test the profile.

Do not append the bucket name to the endpoint. Avoid retention rules that prevent deletion when the application is configured to remove old recordings. See Cloudflare's S3 API guide and object lifecycle documentation.

How to Use Backblaze B2 as External Storage

  1. Sign in to the Backblaze web console, open B2 Cloud Storage / Buckets, click Create a Bucket, choose Private, and save its name and region.
  2. Open Application Keys / Add a New Application Key. Restrict it to the recording bucket, enable Allow List All Bucket Names, and grant read and write access. The key needs listFiles, readFiles, writeFiles, and deleteFiles.
  3. Copy the generated keyID and applicationKey; the application key is displayed only once. Do not use the account's master application key.
  4. Create an S3-compatible profile. Use https://s3.<REGION>.backblazeb2.com as HTTPS endpoint, for example https://s3.us-west-004.backblazeb2.com. Enter the same region code, such as us-west-004, in Region.
  5. Enter the bucket name, optional folder, keyID as Access key, and applicationKey as Secret key, then save and test.

B2 retains old object versions by default. Configure bucket lifecycle rules to remove hidden or previous versions if deleted recordings must immediately release storage quota. See Backblaze's S3-compatible API guide and application-key guide.

How to Use Wasabi as External Storage

  1. Sign in to the Wasabi Console, open Buckets / Create Bucket, enter a unique name, and select the region nearest the agents.
  2. Keep the bucket private. For predictable application quota cleanup, leave versioning and Object Lock disabled, or configure lifecycle rules that remove retained versions.
  3. Create a dedicated sub-user and policy, where available, granting list-bucket plus get, put, and delete object access only to this bucket. Open Access Keys / Create New Access Key for that user and copy or download the key pair.
  4. Create an S3-compatible profile. Use the service URL for the bucket's region as HTTPS endpoint. For us-east-1, use https://s3.wasabisys.com; for another region, copy its regional service URL from Wasabi's documentation or console.
  5. Enter the exact Wasabi region code, bucket name, optional folder, Access Key, and Secret Key, then save and test.

The endpoint region and Region field must match the bucket. See Wasabi's bucket guide, user and access-key guide, and service URLs.

How to Use DigitalOcean Spaces as External Storage

  1. Sign in to the DigitalOcean Control Panel, open Spaces Object Storage, and click Create Bucket.
  2. Choose the datacenter region, select Standard storage for recordings that will be listed and played regularly, enter a unique Space name, and keep file listing restricted.
  3. Open the Spaces access-key page and create a dedicated key. Restrict it to the Space when available and grant read, write, list, and delete access. Copy the Access Key and Secret Key when shown.
  4. Create an S3-compatible profile. Set HTTPS endpoint to the region's origin endpoint, https://<REGION>.digitaloceanspaces.com, for example https://nyc3.digitaloceanspaces.com. Do not use a CDN or static-website endpoint.
  5. Set Bucket to the Space name and Region to its code, such as nyc3. Enter the key pair and optional folder, then save and test.

See DigitalOcean's Spaces quickstart, access-key guide, and S3 compatibility reference.

How to Use MinIO as External Storage

  1. Open the MinIO Console supplied by your administrator and create a private bucket for recordings.
  2. Create a dedicated user or service account and an access key. Attach a policy that permits s3:ListBucket on arn:aws:s3:::YOUR_BUCKET and s3:GetObject, s3:PutObject, and s3:DeleteObject on arn:aws:s3:::YOUR_BUCKET/*.
  3. Ask the administrator for the externally reachable S3 API URL and signing region. The API URL, such as https://storage.example.com:9000, is not necessarily the MinIO Console URL.
  4. Create an S3-compatible profile. Enter the S3 API URL as HTTPS endpoint, the bucket name, optional folder, and the configured region. Use us-east-1 only if the administrator confirms that the default region is in use.
  5. Enter the access-key and secret-key pair, then save and test from the console computer and from the networks used by agents.

All agents need DNS and network access to the API endpoint. Use HTTPS; if MinIO uses a private certificate authority, install that CA as trusted on every agent computer. Do not enable Object Lock if the application must delete old recordings. See the MinIO documentation and access-key documentation.

How to Use Hetzner Object Storage as External Storage

  1. Sign in to the Hetzner Cloud Console, select a project, open Object Storage, create a bucket, and choose its location.
  2. Save the location code: fsn1, nbg1, or hel1. Keep the bucket private.
  3. Open Security / S3 Credentials, click Generate credentials, add a descriptive name, and securely copy the Access Key and Secret Key. The secret is shown only once.
  4. Create an S3-compatible profile. Set HTTPS endpoint to https://<LOCATION>.your-objectstorage.com, for example https://fsn1.your-objectstorage.com.
  5. Enter the bucket name, optional folder, location code in Region, and the generated credentials, then save and test.

If the credentials are shared with other applications, use a bucket policy to limit access to the recording bucket. See Hetzner's Object Storage overview and S3 credential guide.

How to Use IBM Cloud Object Storage as External Storage

  1. Sign in to the IBM Cloud console, create or open a Cloud Object Storage service instance, and create a private bucket. Select its location, resiliency, and storage class, then record the exact bucket name and location code.
  2. Open Service credentials / New credential, select a role that permits listing, reading, writing, and deleting objects, such as Writer, and turn on Include HMAC Credential.
  3. Create the credential and expand it. Under cos_hmac_keys, copy access_key_id and secret_access_key. Do not put the IBM Cloud apikey in the S3 fields.
  4. On the bucket's Configuration page, copy its public S3 endpoint and signing location. Agents outside IBM Cloud normally need the public endpoint, for example https://s3.us-south.cloud-object-storage.appdomain.cloud.
  5. Create an S3-compatible profile. Enter the endpoint without the bucket name, enter the exact bucket name, optional folder, and the bucket's signing location in Region. For example, a US Standard cross-region bucket uses us-standard; do not infer this value only from the endpoint hostname.
  6. Enter the HMAC access-key ID and secret, then save and test.

Use a public, private, or direct endpoint only when every agent has the corresponding routing and DNS access. See IBM's service-credential guide, HMAC credential guide, and endpoint reference.

Google Cloud Storage

Use a dedicated bucket, service account, and HMAC interoperability key. The profile does not accept a downloaded JSON service-account key.

1. Create the project and bucket

  1. Sign in to Google Cloud Console and select or create a project with billing enabled.
  2. The administrator creating the key needs Storage HMAC Key Admin (roles/storage.hmacKeyAdmin). If key creation is unavailable, check organization policies that restrict authentication types or service-account keys.
  3. Open Cloud Storage / Buckets / Create. Enter a globally unique name, choose a suitable location, and use Standard storage unless you have reviewed colder-tier retrieval and retention charges.
  4. Use Uniform bucket-level access and public access prevention. New buckets have seven-day soft delete by default; disable it for predictable quota cleanup or account for retained, billable deleted objects. Avoid retention locks when old recordings must be deleted.
  5. Keep Google-managed encryption unless your organization specifically requires customer-managed keys, then create the bucket.

2. Create and authorize the service account

  1. Open IAM & Admin / Service Accounts / Create service account, use a name such as recording-storage-agent, and finish without a project-wide storage role.
  2. Open the recording bucket's Permissions page, click Grant access, add the service-account email, and grant Storage Object User (roles/storage.objectUser) on this bucket only.
  3. This role supplies the required create, get, list, update, and delete object permissions.

3. Create the HMAC key and fill the profile

  1. Open Cloud Storage / Settings / Interoperability, click Create a key for a service account, and select the recording service account.
  2. Immediately copy the HMAC Access ID and Secret; the secret is displayed only once. Allow up to 60 seconds for the key to become usable.
  3. Create a Google Cloud Storage profile. Leave HTTPS endpoint empty, enter the exact Bucket, optionally enter a Folder, and keep Region set to auto.
  4. Enter the HMAC Access ID under Access key and its matching secret under Secret key. Set the recording quota manually or leave it unlimited, then click Save and Test connection.

Troubleshooting

  • 403 AccessDenied: check the bucket-level role, service-account email, and organization deny policies.
  • InvalidAccessKeyId: use the HMAC Access ID, not the service-account email, OAuth client ID, or JSON key.
  • SignatureDoesNotMatch: re-enter the matching secret and correct the agent computer's clock.
  • 404 NoSuchBucket: verify the exact bucket name and project. If storage remains occupied after deletion, check soft delete, Object Versioning, and retention policies.

Google: Create a bucket · Google: Create a service account · Google: Storage IAM roles · Google: Manage HMAC keys · Google: Soft delete

Azure Blob Storage

Use a storage account dedicated to recordings when possible. The profile uses Shared Key; Microsoft Entra ID and SAS tokens are not accepted by these fields.

1. Create the storage account

  1. Sign in to Azure Portal, open Storage accounts / Create, and select a subscription and resource group.
  2. Enter a globally unique 3–24 character name using lowercase letters and numbers. Select a nearby Region, Blob storage, Standard performance, and the required redundancy.
  3. Use the Hot tier for recordings played regularly. On Networking, allow the agents' public IP addresses or provide routing and DNS to a private endpoint.
  4. On Security, require secure transfer and TLS 1.2, disable anonymous access, and keep Enable storage account key access enabled.
  5. Soft delete and versioning improve recovery but retained data can consume storage. Disable them for predictable quota cleanup or configure suitable lifecycle rules. Avoid immutability policies when old recordings must be deleted.
  6. Click Review + create, then Create.

2. Create a container and obtain the key

  1. Open Data storage / Containers / + Container. Enter a 3–63 character lowercase name and select Private (no anonymous access).
  2. Open Security + networking / Access keys / Show keys. Copy only the Key under key1 or key2, not the connection string. Protect and rotate this broad-access credential.

3. Fill the profile

  1. Create an Azure Blob Storage profile. Leave HTTPS endpoint empty for https://<account>.blob.core.windows.net; use a custom endpoint only for a compatible private endpoint or Azure Stack deployment.
  2. Enter the exact existing Container, an optional Folder, the Storage account name, and only the copied Key under Account key (Base64).
  3. Set the recording quota manually or leave it unlimited, then click Save and Test connection.

Troubleshooting

  • 403 AuthenticationFailed: verify the account and key, enable storage account key access, and correct the agent's clock.
  • 403 AuthorizationFailure: check firewall rules, IP ranges, virtual networks, and private-endpoint routing.
  • 404 ContainerNotFound: create the container first and enter its exact lowercase name.
  • If usage remains high after deletion, check soft delete, versioning, snapshots, lifecycle rules, and immutability. After key rotation, update the profile and reapply recorder settings.

Microsoft: Create a storage account · Microsoft: Create a Blob container · Microsoft: Manage account keys · Microsoft: Shared Key setting

Save, Test, and Assign the Profile

  1. Click Save, then Test connection. The test uploads, lists, downloads, deletes, and cleans up a temporary object.
  2. Open Desktop Recorder or Audio Recorder.
  3. Select the named profile under Recording storage and click Apply settings for the selected agents.

Stored paths use folder / agent host name / desktop-recordings and folder / agent host name / audio-recordings.

Ready to start monitoring your employees?

Buy this application now. You will never regret your decision.

Buy Now