Record a Remote Mac Session for Audit Trails

Published November 11, 2026 • Figment editorial team

When a contractor or support technician logs into a Mac you are responsible for, "what did they do?" needs a verifiable answer. A timestamped screen recording stored outside the session user's home folder gives you that answer for incident review, billing disputes, and compliance evidence of privileged access.

This guide pairs ffmpeg with a system LaunchAgent so recording starts at login, stops at logout, and lands in an admin-owned folder with ISO 8601 filenames. We recommend running it on a Figment physical Mac (i3 from $49/month or M-series from $95/month entry; specific chip, RAM and disk are confirmed in the quote) because this use case needs a conventional VNC login session for contractors to connect to. The $29 virtual Intel macOS plan is a real macOS environment and runs compatible Intel toolchains, but its access path is a browser console — not the multi-user VNC login flow this recipe records. Request your configuration at figment.com/mac-hosting/start.

Three Reasons to Record Contractor Sessions

Incident review — if a contractor deletes or modifies the wrong files, you can establish exactly when it happened and what preceded it.
Billing disputes — hourly contractors and support vendors sometimes bill for time that is hard to verify later. Timestamped recordings confirm active screen time.
Regulated access evidence — financial services, healthcare and government-contract environments often require documented evidence of privileged access activity.

macOS already produces screen recordings as .mov files on demand via Shift-Command-5 (Apple Support — Take screenshots or screen recordings). That tool is useful for one-off captures but useless for compliance: the session user controls when it starts and stops, and the output lands on their Desktop. The LaunchAgent approach below takes that control away from the session user.

Prepare the Recording Folder and Install ffmpeg

Install ffmpeg once as an admin:

brew install ffmpeg

Create the recordings directory outside any session user's home folder. The sticky bit lets each user write files but only the owner or root can delete them, so a session user cannot erase a recording that captured them:

sudo mkdir -p /var/session-recordings
sudo chmod 1777 /var/session-recordings
# 1777 = sticky bit + rwx for all. Any user can create files;
# only the owner or root can delete them.

Confirm the AVFoundation screen index — it varies by machine:

ffmpeg -f avfoundation -list_devices true -i "" 2>&1 \
  | grep -A20 "AVFoundation video"
# Look for a line like: [1] Capture screen 0
# Record that index; the LaunchAgent below uses it.

Then grant System Settings → Privacy & Security → Screen Recording permission to the binary that will run ffmpeg (typically /opt/homebrew/bin/ffmpeg on Apple silicon, /usr/local/bin/ffmpeg on Intel). Without this, ffmpeg writes black frames and logs a permission error.

The Wrapper Script and LaunchAgent

Place the plist in /Library/LaunchAgents/. Apple documents this as the global-per-user agent location: launchd starts these agents for every user that logs in and sends SIGTERM to them when that user logs out (Apple Developer — Creating Launchd Jobs). Because the directory is admin-owned, the session user cannot unload or edit the job, and SIGTERM gives ffmpeg a chance to flush the trailing frames and finalise the MP4 container.

Step 1 — wrapper script (/usr/local/bin/start-session-recording.sh):

#!/bin/bash
# Started by launchd at user login. Stopped by SIGTERM at logout.
set -euo pipefail

RECORDINGS_DIR="/var/session-recordings"
if [[ ! -d "${RECORDINGS_DIR}" ]]; then
  echo "ERROR: ${RECORDINGS_DIR} missing. Admin must create it." >&2
  exit 1
fi

SCREEN_INDEX="1"   # from the list_devices step above
TIMESTAMP=$(date -u +%Y%m%dT%H%M%SZ)
OUTFILE="${RECORDINGS_DIR}/session-${USER}-${TIMESTAMP}.mp4"

exec ffmpeg \
  -f avfoundation \
  -r 10 \
  -i "${SCREEN_INDEX}:" \
  -vcodec libx264 \
  -preset ultrafast \
  -crf 30 \
  -pix_fmt yuv420p \
  "${OUTFILE}"

Make it executable: sudo chmod +x /usr/local/bin/start-session-recording.sh.

Step 2 — LaunchAgent plist at /Library/LaunchAgents/com.company.session-recorder.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.company.session-recorder</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/bin/start-session-recording.sh</string>
  </array>
  <key>RunAtLoad</key><true/>
  <key>KeepAlive</key><false/>
  <key>StandardOutPath</key>
  <string>/var/session-recordings/launchd-recorder.log</string>
  <key>StandardErrorPath</key>
  <string>/var/session-recordings/launchd-recorder-err.log</string>
</dict>
</plist>

Set ownership and load it:

sudo chown root:wheel /Library/LaunchAgents/com.company.session-recorder.plist
sudo chmod 644 /Library/LaunchAgents/com.company.session-recorder.plist
launchctl load /Library/LaunchAgents/com.company.session-recorder.plist

Encoding knobs you may want to change: -r 10 keeps keyboard-and-mouse activity legible while cutting file size; -crf 30 controls quality (28–32 is a reasonable audit band, lower is sharper and larger); -preset ultrafast keeps CPU off the contractor's workload. Treat sizes as your own measurement, not ours — test one real session before you rely on a number.

SIGTERM caveat. ffmpeg generally finalises the MP4 when it receives SIGTERM, but not if the Mac is powered off abruptly or the process receives SIGKILL. Log out mid-recording once and play back the file end-to-end before you treat the pipeline as production.

Filenames, Retention and Off-Box Storage

Files land as:

/var/session-recordings/session-contractor42-20261110T143022Z.mp4
/var/session-recordings/session-contractor42-20261112T091500Z.mp4

ISO 8601 UTC sorts chronologically in any listing and avoids timezone ambiguity.

Prune on a schedule with find, run from a LaunchDaemon or admin cron:

find /var/session-recordings -name "session-*.mp4" -mtime +90 -delete

For long-term compliance archives, push completed files off the Mac after each day. rsync to an SFTP target or rclone to an S3-compatible bucket both work:

rsync -avz --remove-source-files \
  /var/session-recordings/ \
  audit@audit-server.example.com:/mac-recordings/

Keep the destination credentialled with a key that only the admin account can read — the goal is to move recordings somewhere the contractor's account cannot reach.

Privacy and Disclosure

Recording a user's screen without disclosure creates legal and HR exposure that varies by jurisdiction. Before you deploy this:

Say so in writing — employment contract, service agreement or acceptable-use policy — that sessions on company equipment may be recorded.
Confirm employment and data-protection rules for your location and the contractor's location; some require explicit consent, others accept notice.
Restrict read access on the recordings folder and archive bucket to the admin account. Treat the files like other HR-sensitive records.
Commit to a written retention and deletion window; do not keep recordings indefinitely by default.

Ready to run this on a dedicated machine? Start a Figment Mac request at figment.com/mac-hosting/start or review the plan catalogue at /mac-hosting.