How to monitor employee computer activity: a guide

Meet Monica, who runs operations at a company with an office team and a remote team. Arjun uses a Windows laptop and Sara uses a Mac. They're fictional, but their questions will feel familiar. Monica wants employee computer monitoring for her workforce that answers one question without turning into surveillance.

We'll follow Monica as she plans, picks a method, sets up a test and writes the notice, and we'll check what Arjun and Sara see from their side.

What should you decide before you monitor anyone?

A short plan comes before any tool. Write down why you want the data, and tie every later choice to that reason. The plan takes an afternoon, and it answers most of the questions employees will ask. Skipping it is how a helpful project turns into a trust problem.

• Purpose: one sentence, such as "see why the project keeps slipping".
• Data: each item you will collect, listed one by one.
• Access: the named roles that can see it.
• Retention: how long you keep it, and when it is deleted.

Monica's project keeps running late. She suspects the calendar and the software, not slow people, so her purpose is to find where the hours go.

In short: if you can't state the purpose in one sentence, you aren't ready to collect anything.

What are the ways to monitor employee computer activity?

Monitoring employee internet use and computer activity is a menu, not one switch. Each method answers a different question, and the heavier ones collect far more. Pick the lightest method that answers the question you wrote down. Some teams combine two. Few need all six.

Monica's question is about time, so she starts with app and website time. Screen recording would answer a question she didn't ask, and it would collect far more than she needs.

In short: the more a method captures, the stronger your reason must be.

Can the tools already in Windows, Mac and Microsoft 365 do the job?

Built-in tools answer security and licensing questions well, but they aren't made to show a manager where a team's time goes. Check what a tool reports and who sees it before you rely on it for monitoring employee computer use. The table sums up what each vendor's own pages say.

Microsoft's archived page on advanced audit policy settings, last updated in September 2021, says Windows can track defined activities, such as an employee in a group opening an important file, and deploy the settings with Group Policy.

Microsoft's usage reports hide user names by default "to help companies support local privacy laws," and a global administrator can show them. Insider Risk Management is a compliance tool that pseudonymizes users by default.

For Mac, Apple says device management can configure settings, monitor compliance and apply restrictions. We found no manager activity report on the pages we read.

Sara asks IT whether her Mac is being watched through device management. IT explains that it sets rules and checks compliance, and points her to the written policy.

In short: logs protect the company, and activity software answers workload questions.

How do you set up computer monitoring step by step?

Set up in the order a vendor's own docs lay out: account, organization, teams, people, then the agent. This guide uses We360.ai, our product, because we can check its docs line by line. Other tools differ, so read each vendor's setup pages.

Arjun's laptop is the first one Monica sets up, and it goes quickly. He downloads the installer, signs in and clicks Punch In. The only slow part is waiting for IT to confirm the firewall allows the connection.

The steps below follow We360.ai's 5-minute launch guide.

• Create an account on the portal and sign in as Super Admin.
• Set your organization's name, logo and time zone.
• Build departments and job titles under Settings, then User Management.
• Invite employees by email or bulk CSV, with a team, title and role.
• Check the requirements, and on a Mac grant three permissions.
• Install the agent on one pilot computer, then roll out.

The pre-flight check lists Windows 10 or later, macOS 13 or later and Ubuntu 20.04 or later, with 4 GB of RAM, 500 MB of free disk space and outbound HTTPS on port 443.

On a Windows computer, the Standard install guide says admin rights aren't needed. The employee signs in with a workspace name, email and password, then clicks Punch In. IT teams can use the Agent Deployment Hub for mass deployment.

After the install, the launch guide suggests setting working hours and labeling apps and sites as productive, unproductive or neutral for each team.

In short: the install is the easy part, so spend your time on the choices that come after it.

Why run a pilot, and what should it check?

A pilot is a small trial that finds problems while they're cheap to fix. The pre-flight check says to install on a single pilot machine, let it run for 5 to 10 minutes, and check the dashboard. We'd add a second round with a small team for a few weeks.

• Does data appear for both Windows and Mac computers?
• Are screenshots, if on, blurred or switched off for sensitive teams?
• What does the employee see in their own analytics?
• Do the app labels match the tools the team really uses?
• Did the pilot users get the notice before the install?

Sara's Mac reports almost no activity on day one. Monica's first thought is that Sara isn't working. The cause is simpler: the docs say that without the three Mac permissions, the agent reports zero productivity on macOS, and nobody had granted them.

In short: the pilot's real job is to catch the mistake you'd have blamed on a person.

Which parts of the workday can monitoring see, and which can't it?

Monitoring employee computer activity shows what happened on a work device, such as apps, sites, time and screens. It can't show why, or what happened away from the device. Ask any vendor for a written list of what it collects. Here is how We360.ai's docs answer that question.

Arjun asks Monica what the screenshots show. She opens the settings page and shows him that screenshots can be switched off for a team and blurred for everyone else.

What it collects on a work computer.

• The app or site in focus, per second
• Keyboard and mouse activity, not what was typed
• Screenshots at a set interval, if switched on

Where you control it as an admin.

• Screenshot interval, blur level and off switches per team
• Limits to designated work hours
• Each employee can view their own analytics

What it never collects from employees.

• Individual typed characters
• Webcam feeds

The privacy docs list what is and isn't captured, and the screen tracking docs cover blur and per-team switches. Video screen recording is optional and off by default.

One honest limit applies to every tool: it sees the computer, not the person. A call taken on a phone or a hallway talk leaves no trace, and an app in focus doesn't prove effort.

In short: read the "never" list as closely as the "collects" list.

Which notice do employees need, and what does US law say?

Tell employees before collection starts, in writing, and keep their acknowledgment. Some states require it, and it's the fairer course everywhere. The table gives examples from the sources we read, and it isn't a map of US law. Where your staff work decides which rules apply.

About half of workers believe their employer already monitors them. The American Psychological Association's 2026 Work in America survey, run by the Harris Poll with 2,009 US workers, found that approximately half said so. It measures belief, not proof, but it means silence doesn't read as no monitoring.

The federal rule is in 18 U.S.C. 2511. New York's is in Civil Rights Law 52-c, with penalties of up to $3,000 for a third offense. Delaware's is in Title 19, section 705.

California's notice rule sits in the California Consumer Privacy Act (CCPA), at Civil Code 1798.100. We read all four on October 21, 2026. This is general information, not legal advice. Other states have rules we didn't check, so ask a lawyer.

A notice should say what is collected, why, who sees it and how long it's kept. We360.ai's launch guide suggests briefing managers first, then a company-wide meeting, shared dashboards and a feedback channel.

Monica sends a clear notice and holds the meeting. Then Sara asks how long the data is kept, and Monica has no answer. She had never set a retention period.

In short: an acknowledgment only protects anyone if the notice says everything you collect.

How do you monitor without micromanaging?

Employee activity monitoring turns into micromanaging when someone reads minutes instead of patterns. Look at weekly trends, talk to the person before you judge a number, and use what you find to fix blockers such as a crowded calendar. Let each person see their own data.

Monica opens her first weekly view and sees Arjun's productive time looks low. Before she says a word, she checks how his design tool is labeled. It's marked neutral, so his best hours aren't counted.

• Review weekly trends, not single days.
• Ask the person before you draw a conclusion.
• Show each person their own data.
• Limit tracking to work tools and work hours.
• Fix blockers first, such as a crowded calendar.
• Review the plan every quarter, and cut what you don't use.

We360.ai's privacy docs say employees can view their own analytics and that monitoring can be limited to designated work hours. They also say analytics aren't positioned as a tool for micromanagement.

See how employees view their own data, how employee tracking works, and how to roll out monitoring without demotivating people. For the employee view, read signs of being monitored at work.

In short: a number is a reason to ask a question, never the answer.

FAQ