Delinea Secret Server Remote Session Recording

[Solution_Provider]

Firstly, I would like to thank you so much for the wonderful product you provide!   My Company and I’ve been your satisfied customers for several years and today I’m facing a big challenge, and I’m hoping you’ll be able to help us!
 
We’re using Delinea (formerly Thycotic) Secret Server and our security team has warned us that they want for us to discontinue using Rocket because it is unable to produce recordings like they do if we're using their Delinea’s "Connection Manager" or “RDP launcher (recorded)” plugin they have, so that all the remote desktop sessions get automatically recorded for them at the Secret Server’s Cloud to analyze with their Delinea’s Iris AI. 
 
I immediately asked them to give me some time to contact you so that I can ask if there may be a way to integrate this function, as we’re currently able to connect and synchronize Delinea’s passwords, use MFA with our current Rocket 18 Patch 8 setup without any problem, but the only thing I cannot figure out is how to produce this recording at the Secret Server Cloud they want. (Maybe there is already a way to do this, and I just don't know how to do it in Rocket?)
 
We certainly hope you have some sort of solution for that function on the Delinea plugin, as I would really, really like to continue using Rocket, and the security team has this requirement that they now want all these RDP sessions recorded on their Secret Server Cloud. If this is something you could integrate, it will be wonderful!
 
Is there a way you can help us? 

[DevOma]

Hi - we have also recoding in Rocket Remote Desktop - but as I understand that is something that need to be configured in Delinea and should work OOO


How Delinea session recording actually works
1. Recording is policy‑based, not API‑triggered
Session recording is enabled in Secret Server by:

Global session recording settings
Secret Policies
Protocol handlers / proxies
(Optional) Advanced Session Recording Agent (ASRA)

Once enabled, every session launched through Secret Server that matches the policy is recorded automatically. There is no REST API to say “start recording now” or “attach recording to this session.”
[docs.delinea.com], [docs.delinea.com]

2. What exactly gets recorded
Depending on the setup and license level, Delinea can record:

MethodWhat is recordedRDP / SSH ProxyKeystrokes + metadataProtocol Handler (client launcher)Screen captures → compiled to videoAdvanced Session Recording Agent (ASRA)Full screen video, keystrokes, commands, processes
All of this is transparent to your application once configured.
[docs.delinea.com], [sujitpawar...ixsite.com]

3. Storage and playback model (important for your question)
On‑prem Secret Server

Videos stored in SQL database or file system
Played back inside Secret Server UI
Converted to WebM or MP4 automatically

Secret Server Cloud

Videos captured and stored in Delinea’s cloud
Playback via Delinea Platform UI
Customers do not manage raw video files

[Solution_Provider]

Thank you so much for your reply, DevOma!
I wish I fully understood what you’re trying to communicate to me. I notice your points #1, #2 & #3 and I fully agree with those concepts.
What we need to know is if there is a way for my Company to continue using Rocket, configured to use Rocket’s Delinea plugin that pulls the password from the Secret Server, and then use the Secret Server on-prem Windows Servers as Microsoft Gateways, which are the ones being used already by Delinea’s RDP launcher(recorded) which uses a plugin installed in our workstations:    
Right now, the "secret" of my admin account is stored at the Secret Server and configured to record sessions using it. When using Delinea’s tool, first I get what is shown here:      which is just a message and the top of the RDP session that shows:     so we know the servers that are being used to proxy and we can enable Microsoft’s RDP Gateway to configure Rocket as we're planning to use this:     because the way it is now, it doesn’t work, but we know it will work if we also configure the Secret.Server.Proxy.Name as a Microsoft RD Gateway.

So, the most important thing we need to know for sure is, if we can use Rocket instead of Delinea’s "RDP launcher(recorded)" and still get Secret Server to record our session to their Delinea’s Cloud? Is this something that is categorized as a Feature Request?

We are aware that Rocket is able to record videos of the session, but what we need is for Delinea to be smart enough to say “Oh! This user is accessing an RDP session using Rocket and is configured to use a Secret Server credential that is configured to record the session in our cloud storage, so this session will be automatically recorded even though the user is not using the Delinea’s RDP launcher plugin" ...and wholeheartedly hope that Rocket can be configured, or could be configured in the future, to interact with Delinea in such a way that the above can be possible.

Please help us DevOma! You're our only hope!

[DevOma]

Ok now I know the details - and I will discuss with our internal IT to setup the same - we are using also Delinea in our company so it should be possible to configure and test it - give me some time for research!

[Solution_Provider]

 WOW! I really appreciate you DevOma! You have always been so helpful and extremely skilled! You and your workmates produce very impressive results, and we love using your software!

Please count on me if there is ever anything I can do to help! 

[DevOma]

I checked what is possible - and Delinea is not working in the way other PAM solutions do - only chance is to use the Delinea Components to launch sessions and use integrated functions like Session recording. Other PAM solutions use Gateways that you can access.

So only possible way would be to launch external Delinea tool for session start - but I guess that is not what you expect and I also do not like it... we can't integrate these sessions into our UI.

[Solution_Provider]

Is there a way to invoke the Delinea tool from Rocket? Like some sort of a new feature to define a specific use case connection object configuration where Rocket is setup to call the Delinea's RDP launcher(recorded) from the inside of Rocket's structure?

Like some sort of a relay where Rocket passes the parameters to the Secret Server? We can have the web interface open at the same time as Rocket. And since we already have the      plugin program already installed in our workstations and it seems to tie with MSTSC.EXE there may be a way to gather all parameters from a Rocket object and just relay the payload to the Delinea's interface and have it executed?

We just really want to continue using Rocket because we like it so very much, and I don't know if you have seen Delinea's Connection Manager, because if you have, you'll know what I mean on how important it is for us to be able to satisfy that session recording requirement using Rocket, even if it is not something that can happen in a short term. If there is even a small potential to make this work, we can present it to upper management to "keep the door open"

Hopefully you and your excellent Team will have some good ideas on how to approach this scenario and be able to engineer something that is viable for us to continue using your excellent and useful product!

[DevOma]

I will care on it next week...

[DevOma]

Hi - I have done some more research - the only way we could launch a session is starting on a synced credential - if used only for 1 destination system - then it should start directly (didn't test) - else Delinea will ask for the destination - we can't post that system to Delinea! So it would be a really basic implementation - don't know if that really make sense? If you think so we could add and let you test...

[Solution_Provider]

Thank you so much for investigating and finding an option, Oliver!

I would definitely like to try that solution. Please let me know how I should proceed...

[Solution_Provider]

Greetings!
Please let me know if you when you feel comfortable for me to test anything you have, and I'll be glad do it and provide feedback.
Thanks again for working on this!

[DevOma]

https://rrddownloads.rocketsoftware.com/..._Setup.zip

Can't test it completely as in our environment it is not allowed to pass saved credentials - please tell me your results - right click on a synced credentials and choose RDP-Launcher

This is the new main release based on .NET 8 - just FYI

[Solution_Provider]

Thank you so much for working on this, Oliver!
(I made sure I have installed .NET 8.0.28)
Currently, I'm running Rocket Remote Desktop Version 2025_Patch8
First, I downloaded the Beta version you provided (RocketRD2026_Patch1_Beta1_x64_Setup.zip) and got some errors just opening the software as I have configured auto sync credentials upon login, and our Delinea configuration requires for us to provide an MFA code to login to their web portal, which by the way, Version 2025_Patch8 doesn't actually prompt for and works just fine, and this Beta version prompts for the code:
   
After typing the code, there are two errors popping:
   
then:
   
So, I removed the automatic sync upon application startup, and tried manual inspection of the Delinea Secret Server folder objects, which pops the MFA prompt:
   
...and then shows this error:
   
...followed by an empty secret list:
   

Then I tried downloading the regular 2026 version (RocketRD2026_x64_Setup.zip) to compare behavior, and it is exactly the same experience. So, for some reason, Rocket doesn't seem to be happy processing the MFA prompt to log into Delinea.

I continue using Rocket 2025_Patch8, which is currently not prompting for Delinea's MFA yet works just fine, and of course if I open Delinea's portal I get prompted for the MFA on the web browser, and it also works just fine.

Hopefully this information is helpful?

[Solution_Provider]

...by the way, I have tried with and without a checkmark here:
   
...and it makes no difference. In Version 2025 it works without asking for any input whether the checkmark is there or not. It made sense to me because the Entra login requirement for users to provide MFA is technically not applicable for the API.

The fact that version 2026 (19.0.896.1) asks for input leads me to believe that it is somehow the one that the Secret Server web portal requires, but not sure why is it acting different than Version 2025.
Maybe the "Web service url" should now be different? If so, how would we know what to put there?

I was trying other "Authentication" options and was curious on the "Bearer Token" choice, as I cannot get it to work, as I have no idea where to obtain or configure this kind of token. Not sure if that would help with Version 2026?

Let me know if you would like to have some sort of a shared session or something to take a look at the situation together?

[DevOma]

Perhaps you missed to change the URL - we deprecated the old SOAP API - only supporting the REST-API now - so you should set https://yourserver" - I will rename the text of the URL field...

[Solution_Provider]

That information helped a lot, Oliver!
I was able to successfully reconfigure, connect and synchronize the Delinea Secret Server credentials with Version 2026 (19.0.896.1) then installed the Beta 2026_Patch1 (19.0.8930.1) and tested by right-clicking an appropriate credential and then selected the "Delinea RDP Launcher" option. Typed the desired computer name to remote-control and received this error:
   
I think we're getting closer now.
Thank you so very much for all your time and efforts!

[pavankumarc]

Can you check logs in Delinea ? Can't seem to reproduce the error

[Solution_Provider]

So sorry for the delay replying!
I've been looking around to see if I could find any sort of Delinea logs and seems like I have no access to see any of the logs.
Also, I tried to reach out to the Delinea administrator, bit he so far hasn't gotten the opportunity to work with me as we both have been quite busy.
I'll definitely try tomorrow to see if he has visibility on that. I wonder if you happen to know where those logs may be, to make it easy for him, as I don't know if he will know where to look, as I have no clue on where he should be focusing on.
Hopefully we'll be able to find something, and as soon as I do, I'll let you know.
Thanks again for your assistance on this matter!

[Solution_Provider]

I was able to consult with our Delinea Administrator, and he couldn't find any error today, even though I tried multiple times and received the error message:    
...but not even a single error has been detected on Delinea's logs for today. There are certainly multiple informational logs, but they all show different events associated to long GUIDs rather than mentioning a user, credential or any human readable information we could find.
Is there any recommendation on how to find the error? We tried searching but found nothing.
We have this installed in our workstations:
   
...which seems to me it is the one that somehow calls the recorded remote-control session.
I wish Delinea's system was more friendly to interact with Rocket.
Any advice will be greatly appreciated!

[DevOma]

You will get new version for testing - but at all we don't need if the way we have implemented is really working... we will see...