The Teramind agent: platforms, agent types and deployment

What the Teramind agent does

Teramind describes the agent as the component that captures detailed user activity on the endpoint and securely sends it to the server for analysis. It also acts as a local enforcement point: when a behaviour rule says block, warn or notify, the agent does it on the computer in real time.

The agent streams its events to the server over encrypted connections and receives its settings, policies and rules back from the server. Teramind's own remote control feature also travels over that agent-to-server connection, so it does not rely on RDP. All agent types keep enforcing rules if the network drops (the Revealed agent only if the user was in an active session), and the Standard and Stealth agents can also keep recording and upload later.

Teramind does not offer an agent for phones and tablets. See Teramind for how the agent fits with the server and dashboard.

Supported platforms

These are the platforms in Teramind's current agent specification:

For remote desktop, where the agent sits matters. On a terminal server it records each RDP user separately under their own profile. On a workstation, an RDP window to another computer is recorded as an application, and Teramind cannot see inside it unless the destination also has an agent. Teramind advises keeping the number of users on a single monitored terminal server modest to avoid a performance impact, and we size this with you.

On Linux, the agent also records interactive SSH terminal sessions as video and captures their keystrokes. Teramind still supports some older Windows agent versions for existing installations, but new deployments should be on the platforms above.

Teramind for Mac and Linux: what differs

Teramind publishes a feature comparison across its three agents. The main differences for monitoring channels are:

On a Mac, apps such as messaging and meeting tools still appear in the applications and websites reports, but their content is not captured as a separate channel. Schedule rules (late, absent, idle and similar) are listed as not supported on macOS. If you have a mixed estate, we can check your requirements against this list with you before you buy.

Revealed, Stealth and Standard agents

Teramind offers three agent types, and only one can be installed on a computer at a time. The differences are practical and legal:

Teramind positions the Revealed agent for transparent monitoring of remote employees, contractors and freelancers who manage their own time and tasks: they can clock in and out and pick the task they are working on. Teramind describes the Stealth agent as designed for discreet monitoring where user awareness is not required, which needs care under UK law (see below). The Standard agent is what trial accounts get; it behaves like the Stealth agent but shows the user a notice at installation.

Why the agent type matters under UK law

A hidden agent is not the same as covert monitoring. The ICO describes covert monitoring as monitoring carried out in a way designed to ensure workers are unaware it is taking place. If your monitoring policy and privacy information tell staff what is recorded, why and when, the monitoring is not covert just because there is no icon on screen. Teramind also documents a rule that shows employees a privacy notice while the Stealth agent is monitoring.

Genuinely covert monitoring is a different matter. The ICO says it is unlikely to be justified in most usual circumstances. In exceptional cases, such as suspected criminal activity or gross misconduct, it expects senior management authorisation, a DPIA, monitoring strictly targeted at obtaining evidence within a set timeframe, and no monitoring after the investigation ends. The Stealth agent must sit inside those limits; read covert monitoring of employees before you consider it.

The Revealed agent is a good fit where workers have higher privacy expectations, such as contractors, people working from home or anyone using their own device, because they control when monitoring runs. See monitoring employees' personal devices. This is general information; take legal advice for your situation.

Deploying the Teramind agent

How you install the agent depends on the agent type and the platform:

• Windows, at scale: the Stealth agent is supplied as an MSI package for silent installation through Group Policy, Configuration Manager (SCCM), Microsoft Intune or PsExec, with installation parameters to set the server and options.
• Windows, from the dashboard: Teramind's dashboard includes a silent remote installer for computers on your network.
• macOS with Jamf: Teramind documents deployment through Jamf, with configuration profiles for permissions and system extensions. Screen Recording permission has to be approved locally on each Mac, unless you use Reconstructed Video (Mac agent 26.1 or newer), which needs only the Accessibility permission that Jamf can grant.
• Revealed agent: installed locally on the computer, and the user signs in to start monitoring.
• Tamper protection: uninstall protection is available for the Stealth agent on Windows and Mac, and for the Revealed agent on Mac.
• Security software: Teramind publishes antivirus and EDR configuration guidance so your endpoint protection does not block the agent.

We plan the roll-out with your IT team or managed service provider, usually starting with a pilot group so settings can be tuned before everyone is included. If your endpoint protection needs reviewing too, see endpoint security and XDR.

Performance, bandwidth and offline recording

Teramind's specification puts the agent's memory use at roughly 30 to 50 MB, varying with user activity and the number of rules enforced. Bandwidth depends on how active people are, how many screens they have and your recording settings, so we estimate it with you rather than quoting a single figure.

Offline recording is off by default and is not available on Linux. When enabled on the Standard or Stealth agent, the agent stores activity locally while disconnected, keeps enforcing rules, and uploads at a throttled pace when the connection returns; the local buffer defaults to 24 hours and can be changed in the monitoring profile. Recording settings such as frame rate, colour depth and recording only on rule violations all reduce bandwidth and storage, and usually reduce intrusion too.

Keeping agents up to date

Teramind's lifecycle policy gives each agent version full support for up to 12 months after it is superseded, critical security patches only from 12 to 18 months, and end of life after 18 months, when the agent stops reporting to the server. On Teramind Cloud you can turn on automatic agent updates; on-premises and private cloud, you update agents and the server yourself. Updates can also be pushed remotely from the dashboard.

We can help you fit agent updates into your change control, and track versions as part of ongoing support. See Teramind deployment options for the server side.