Netwrix Auditor User Activity Core Service -

Enable via registry (temporary):

Records user screen activity as video, allowing administrators to replay sessions to see exactly how a change was made. netwrix auditor user activity core service

C:\ProgramData\Netwrix Auditor\User Activity\Logs\Core\ netwrix auditor user activity core service

Then restart service.