Capturing privileged session activity for audit and forensic purposes. Records keystrokes, commands, and screen activity during administrative sessions.