Close the session on the privileged endpoint
You close a session by using the Close-PrivilegedEndpoint
cmdlet. This cmdlet closes the endpoint and transfers the log files to an external file share for retention.
To close the endpoint session:
- Create an external file share that's accessible by the PEP.
- Run the following cmdlet:
Close-PrivilegedEndpoint -TranscriptsPathDestination "\\fileshareIP\SharedFolder" -Credential Get-Credential
The cmdlet uses the parameters in the following table:
Parameter
Description
Type
Required
TranscriptsPathDestination
Path to the external file share defined as "fileshareIP\sharefoldername"
String
Yes
Credential
Credentials to access the file share.
SecureString
Yes