An audit, monitor, and access control system for use with at least one user computer (12; 14; 16) and with at least one protected computer (30; 32; 34), which system comprises: first software to authenticate authorized access to at least one protected computer (30; 32; 34) by said at least one user computer (12; 14; 16) wherein said first software prompts said at least one user computer (12; 14; 16) for a user ID and password and wherein said first software verifies the response; a server connection network adapter in communication with said at least one user computer (12; 14; 16); a client connection network adapter in communication with said at least one protected computer (30; 32; 34); characterized in the server connection network adapter being in communication with said at least one user computer (12; 14; 16) through an SSH (secure shell) connection; second software to authenticate authorized superuser mode access to at least one protected computer (30; 32; 34) by said at least one user computer (12; 14; 16), wherein said second software utilizes a password or passwords for superuser access different from said first software password and wherein said second software includes filters to restrict communication with said at least one protected computer (30, 32, 34); third software to synchronize said audit, monitor, and access control system with another audit, monitor, and access control system (72; 74), wherein any journaled changes are properly reconciled; a database which records and stores all data transferred and all activity between said at least one user computer (12; 14; 16) and said at least one protected computer (30; 32; 34) such that a session of data transfer and activity between said at least one user computer (12; 14; 16) and said at least one protected computer (30; 32; 34) is live monitored in real time and can be played back from a desired point, rewound to a desired point, and fast-forwarded to a desired point; and at least one administrator computer (50; 52; 54) in communication with said system to browse said data transferred between said at least one user computer (12; 14; 16) and said at least one protected computer (30; 32; 34), wherein said at least one administrator computer (50; 52; 54) monitors all data transferred and all activity between said user computer (12; 14; 16) and said at least one protected computer (30; 32; 34), including status displays, configuration screens, and session playbacks, such that a user of said at least one administrator computer (50; 52; 54) may audit any and all actions performed by a user of said at least one user computer (12; 14; 16) either in real time or at a later time. first software to authenticate authorized access to at least one protected computer (30; 32; 34) by said at least one user computer (12; 14; 16) wherein said first software prompts said at least one user computer (12; 14; 16) for a user ID and password and wherein said first software verifies the response; a server connection network adapter in communication with said at least one user computer (12; 14; 16); a client connection network adapter in communication with said at least one protected computer (30; 32; 34); the server connection network adapter being in communication with said at least one user computer (12; 14; 16) through an SSH (secure shell) connection; second software to authenticate authorized superuser mode access to at least one protected computer (30; 32; 34) by said at least one user computer (12; 14; 16), wherein said second software utilizes a password or passwords for superuser access different from said first software password and wherein said second software includes filters to restrict communication with said at least one protected computer (30, 32, 34); third software to synchronize said audit, monitor, and access control system with another audit, monitor, and access control system (72; 74), wherein any journaled changes are properly reconciled; a database which records and stores all data transferred and all activity between said at least one user computer (12; 14; 16) and said at least one protected computer (30; 32; 34) such that a session of data transfer and activity between said at least one user computer (12; 14; 16) and said at least one protected computer (30; 32; 34) is live monitored in real time and can be played back from a desired point, rewound to a desired point, and fast-forwarded to a desired point; and at least one administrator computer (50; 52; 54) in communication with said system to browse said data transferred between said at least one user computer (12; 14; 16) and said at least one protected computer (30; 32; 34), wherein said at least one administrator computer (50; 52; 54) monitors all data transferred and all activity between said user computer (12; 14; 16) and said at least one protected computer (30; 32; 34), including status displays, configuration screens, and session playbacks, such that a user of said at least one administrator computer (50; 52; 54) may audit any and all actions performed by a user of said at least one user computer (12; 14; 16) either in real time or at a later time.