When you, as an administrator, are monitoring every activity that is performed on a remote machine for a particular session, and if you find an unexpected command that is run on the remote server, you can disconnect the session manually and send the reason for disconnecting the session to the user. You can also block the user from using the session again.
The administrator can disconnect the session when a high risk level or any suspicious activity is displayed in the Report data of the Reports console. To disconnect a user from the session on which an unauthorized command is used, perform the following steps in the Reports console:
Click Command Control Reports then select the report.
Open the session that is active.
In the Disconnect Reason field, specify the reason for disconnecting the session.
This is required for auditing.
(Conditional) If you want to block the user from connecting to the same session, select Block User.
By default this checkbox is deselected. Because you may not want to block the user but warn the user about the unauthorized activity that was performed during the session.
NOTE:When you block a user from a session, the user gets added to the Blocked Users list and the user will be blocked from accessing any of the sessions.
Click Disconnect.