Software for monitoring an employee’s computer

In this article, we present the main functions related to employee computer monitoring in Ewida Audit. It is a Windows desktop application designed for auditing, monitoring, and analyzing the computer environment in a company.

The program can be downloaded from the Download page. Before implementing monitoring, however, it is worth defining the organizational and legal rules that apply in a given company so that the scope of collected data matches the procedures in place.

Computer monitoring and privacy control

Ewida Audit was designed so that monitoring an employee’s computer does not automatically mean violating their privacy. The program does not record the content of typed characters, does not reconstruct passwords, and does not use the computer’s camera to observe the user.

The keyboard and mouse activity analysis mechanism is used to assess work activity, not to read the content entered by the employee. The system can record the number of keystrokes and the application context, but it does not save the actual data being typed.

Depending on the settings, the Agent can also inform the user that monitoring is active by using a system tray icon and additional messages. This makes it possible to implement monitoring openly if that is the model adopted in the organization.

Why use employee computer monitoring

Employee computer monitoring can serve several purposes at the same time. On one hand, it helps better understand how applications and IT resources are used in a company. On the other hand, it supports change control in the environment, data security, and software usage analysis.

In practice, monitoring data makes it possible to check which programs are actually used, how often they are started, how long they remain active, and whether changes appear in the environment that require an administrator’s response. This can be useful both for the IT department and for software license analysis.

Monitoring working time on a computer

One of the basic areas is recording user activity on a computer. The system measures working time in individual applications, and even in specific application windows or Windows system windows. Activity is identified based on keyboard and mouse use.

In the settings, you can define the interval after which no activity should be treated as idle time. This is an important parameter because it affects how active and idle time is counted in the logs. This allows the company to adapt the measurement to its own type of work, for example office work, project work, or analytical work.

Software monitoring and application activity

Software monitoring is one of the main areas of Ewida Audit. The system can record, among other things:

  • total program runtime,
  • foreground runtime,
  • active time,
  • idle time.

In addition, logged information may include the file name, process name, vendor, product, product version, number of launches, number of mouse and keyboard actions, and number of open windows. This makes it possible not only to control activity in general, but also to perform more detailed analysis of application usage.

An important parameter is the time after which the system starts counting employee idle time. By default, this may be 60 seconds, but this value can be adjusted to match the realities of the organization.

Application blocking, installation monitoring, and open window monitoring

Ewida Audit also makes it possible to build a blacklist of applications that should be blocked from starting. This is useful when a company wants to limit the use of certain types of software or enforce established security rules.

A separate mechanism is used for monitoring software installation and uninstallation. It works by tracking changes in the Windows registry and makes it possible to detect when new software appears or when an existing application is removed.

It is also possible to monitor the titles of open windows. This type of log generates a very large number of entries, so it usually requires a sensible retention period or a limited monitoring scope.

Parameters related to software monitoring can be adjusted in the program settings, especially in the areas related to processes, installations, blocked applications, and general Agent settings. This makes it possible to match the scope of collected information to the company’s real needs, without recording excessive data that will not be used later.

Internet monitoring

Internet monitoring makes it possible to record information about visited websites and time spent being active online. Depending on the configuration, it can also support blocking or redirecting unwanted addresses, which is used both for security reasons and for work organization.

The scope of Internet monitoring should be defined carefully. In practice, a staged approach works well: first analyze the basic logs, and only later, if needed, expand the policy to blocking selected categories or addresses.

Monitoring and blocking USB drive usage

Ewida Audit can also monitor USB media usage and support blocking such devices. This makes it possible to reduce the risk of data being taken outside the company by using flash drives, mobile phones, or other external storage devices.

In practice, a device authorization system can be implemented in which only approved media are allowed for use. Other devices can be blocked, and the system records the relevant logs and alerts.

Print job monitoring

Print job monitoring works by analyzing print queues and recording information about jobs printed by the user. The data first goes to Agent Server and then to the Ewida Audit console, where it can be analyzed in reports.

Print logs may include, among other things:

  • document name,
  • printer name,
  • print color,
  • number of copies,
  • print quality,
  • duplex or simplex mode,
  • paper size and orientation,
  • number of printed pages,
  • print size in bytes.

This kind of data can be useful both for security purposes and for cost analysis or control of operational processes related to printing.

Monitoring devices and hardware components

Ewida Audit also makes it possible to monitor hardware changes. When the Agent starts, it performs a quick scan of devices and hardware components, then compares the result with the previous state. This allows it to detect newly added devices or the absence of components that were previously recorded.

This mechanism is based on WMI classes and makes it possible to record hardware differences without having to run a full audit every time. This is useful where a company wants to control changes to employee computer configurations or detect unauthorized hardware modifications.

Remote computer screen preview

Ewida Audit also allows remote screen preview of the monitored computer. This function requires an installed Agent and works as a passive observation mechanism. This means that, unlike solutions such as RDP or VNC, it is not used to take control of the computer, but only to view the screen image.

When working with preview, you can configure, among other things, the size of downloaded images, refresh frequency, cursor capture, fitting the view to the window, and the way images are saved to files. It is also possible to monitor thumbnails of many computers at the same time, which can be useful when supervising a larger number of workstations.