How To Audit User Activity With Remote Desktop Monitoring Software

remote desktop monitoring software - monitor RDP, Citrix, and more with CurrentWare

Hello! Today I will be showing you all of the solutions available in the CurrentWare Suite. Each solution can be purchased individually for the greatest flexibility or as a bundle for the best value. 

The CurrentWare suite can monitor and manage remote, on-premises, and hybrid users, making them ideal tools for managing the productivity and security of a remote workforce.

Alright, let’s get started.

With the CurrentWare web console you can manage policies, review dashboards, and run user activity reports from the convenience of a web browser. 

Your CurrentWare solutions are installed and managed by your company either on-premises or on a virtual machine hosted by a cloud service provider of your choice, giving you full control over your data.

CurrentWare is also a Citrix-ready partner, making Windows VDI deployments simple for your organization.

The CurrentWare Suite includes:

  • AccessPatrol: Device control software 
  • BrowseControl: Internet filtering software
  • BrowseReporter: Employee computer monitoring software 
  • And enPowerManager: Remote PC power manager

Each solution allows you to apply unique policies for each group of users or computers. These policies will be enforced even when the computers are disconnected from the network.

Let’s start with AccessPatrol

With AccessPatrol you can:

  • Use the USB activity dashboards to monitor how portable storage devices and other peripherals are being used in your organization
  • Restrict a variety of peripherals including USB storage devices, phones, and Bluetooth
  • Add approved peripherals to an Allowed List
  • Get device activity reports on-demand, at a set schedule, or when specific events occur
  • And Block file transfers to USB devices based on file name or extension

With BrowseControl you can:

  • Control internet access based on URLs and content categories
  • Schedule unique allow or block lists
  • Prevent users from launching specific applications
  • And block network ports

Let’s move on to BrowseReporter

With BrowseReporter you can:

  • Use the computer activity dashboards to track metrics such as productivity, web browsing, application usage, bandwidth consumption, and active vs idle time of your entire workforce, specific groups, or specific users
  • You can generate user activity reports on-demand, at a set schedule, or when specific events occur
  • Capture screenshots of your users’ desktops
  • And schedule activity tracking to stop monitoring your users at designated off-hours times such as breaks. 

Finally, with enPowerManager you can:

  • Generate reports on computer power states and logon-logoff times
  • Start up, shut down, restart, standby, and hibernate computers on a set schedule or on-demand
  • Configure advanced power policies for mobile computers
  • And provide your end-users with a warning message before their computers shut down

If you would like to try out CurrentWare for yourself you can instantly get a free trial at CurrentWare.com/Download or book a demo with our sales team at CurrentWare.com/Sales

This video is current as of version 7.0, which was released in February 2022. For the most up-to-date information on the latest features please visit our release notes at CurrentWare.com/support/release-notes/

Use CurrentWare’s remote desktop monitoring software to audit logons, internet activity, application usage, and USB activities of your remote users.

Remote desktop solutions are becoming increasingly common with the prevalence of distributed workforces. With employees working from home now more than ever your organization needs to ensure that remote desktop activities are monitored for security, productivity, and compliance purposes. 

In this article you will learn how to use CurrentWare’s remote PC monitoring software solutions to audit the activity of users that are using remote desktop, virtual machines, Citrix, and other Windows-based remote access and virtualization technologies. 

Want to learn more about monitoring user activity in a Citrix environment? Check out this article on Citrix user activity monitoring with CurrentWare

Table of Contents

Click to Show / Collapse

Why Audit Remote User Activity?

Thanks for checking out the latest CurrentWare Video. In this video, we’re going to cover the reasons why you should monitor employee computer activity.

If you like this or other videos we’ve produced, hit the subscribe button below. Stay tuned to the end to learn how to get a free trial of all of the software I demo today.

Employee monitoring involves understanding how your employees are using company provided technology during work hours. There are five main benefits and considerations to employee monitoring that we will cover today:

  1. Employee Productivity management
  2. Addressing inappropriate technology usage, legal liability, and compliance
  3. Managing cybersecurity and data loss prevention
  4. Understanding how remote workers / out of office users are engaging with technology
  5. Understanding bandwidth usage and limiting exposure and costs 

So let’s start off with how monitoring can help employee productivity. 

44% of employees admit to being distracted by the internet at work, and employees in the US have admitted to wasting 1-2 hours a day browsing the internet. 

Employees that know they’re being monitored will avoid excessive personal usage of the internet and computer applications. In addition, in the event an employee is underperforming, employee monitoring reports on their computer activity can be used to help the employee understand their actions and enhance their productivity.

The second important reason to monitor activity is to address inappropriate internet usage & avoid legal liability. 

As compliance requirements increase for various businesses, industries & jurisdictions, employers have a responsibility to ensure their employees are complying with regulations such as HIPAA, CCPA, CIPAA and GDPR. 

By enabling computer monitoring, you can ensure that your staff are complying with these requirements. In addition, by monitoring & setting alerts, you can instantly be notified if employees are visiting inappropriate websites such as pornography, adult or other websites.

The third reason to monitor computer activity is for cybersecurity purposes & to prevent data loss.

By knowing which websites an employee is visiting, which files are being downloaded or shared, and which external devices and endpoints are being used, company administrators can manage cyber security risks and data loss prevention efforts. 

Data breaches and associated risks can cost businesses millions of dollars in damages along with reputational risk, so being aware of these risks and monitoring them can provide significant benefits for every organization. In addition, by using alerts, and setting up risk profiles for users, you can audit activities and groups for questionable employee behavior.

Due to Covid-19, the year 2020 has seen a significant shift to remote work for various companies and organizations. This brings us to our 4th reason to monitor an employee’s computer usage: remote workforce management. 

52% of CIOs surveyed suspect that one or more of their mobile workers have been hacked or caused a mobile security issue in the last 12 months. Employee monitoring software can be used to monitor for high-risk activity and verify that employee activity on company networks is legitimate. 

The final reason to monitor employees is for bandwidth management purposes. With CurrentWare’s BrowseReporter tool, you can determine who is hogging bandwidth by streaming videos and uploading/downloading excessively large files. 

Employees who are hogging bandwidth can slow down the entire network, negatively affecting the productivity of other employees and reducing the performance of business critical operations.

That’s it for this video. If you have any thoughts on this video or other reasons why computers should be monitored, feel free to comment below. 

If you’d like to give any of CurrentWare’s computer and device monitoring solutions a try, please check out our free trial at currentware.com/download or get in touch with us and we’d be happy to help!

Note: The above video showcases a legacy user interface for BrowseReporter. To see the most up-to-date features and interface please visit the BrowseReporter product page

Meet Security Compliance Requirements

security compliance audits - 7 tips to meet compliance from CurrentWare
Preparing for a security compliance audit? Check out these 7 tips.

Remote desktop monitoring software keeps a detailed history of users who have connected to the corporate network, along with their usage details. These reports are valuable security tools for compliance and auditing purposes. In the event of a data breach the activity of users can be audited for high-risk, anomalous, and suspicious activity.

CurrentWare’s central console ensures that you have the most important user activity data accessible from one place, allowing you to generate user activity reports easily. Reports can be generated on-demand, at a set schedule, or when specific activities occur.

Detect Insider Threats

Insider threats - how to protect your data. CurrentWare

User activity monitoring is an essential part of mitigating insider threat risks. This is especially true when users are allowed to access internal resources from outside of the network. 

By auditing remote user activity you can detect high-risk and anomalous activities such as large file transfers to USB storage devices, inappropriate internet usage, and the use of unsanctioned applications.

With CurrentWare’s monitoring software you can leverage detailed user activity monitoring reports to enhance your insider threat detection strategy.

Monitor Remote Employee Productivity

Image with text: Managing productivity and security of remote workers

When employees work from home (or other remote locations) there is far less visibility into their work habits than when they work in the office. 

Remote desktop monitoring software tracks the activity of these employees to ensure that working hours are being used efficiently. Depending on the needs of your environment you can monitor employee productivity while they are connected to a Windows terminal server, a remote workstation, or their local device. 

Dedicated monitoring software keeps all internet browsing data intact so that users cannot hide their internet usage by deleting their history.

If excessive unproductive web browsing and application usage is detected, you can address this productivity concern before it escalates. 

Enforce Acceptable Use Policies

Paper document that says "Internet Usage Policy"

Company policies are valuable tools for communicating security, decency, and productivity standards to end-users. Monitoring computer activity with remote desktop monitoring software ensures that these policies are being followed. 

With the monitoring software in place you will be alerted to any instances of misuse, allowing you to provide remote employees with appropriate corrective actions.

Track Software License Usage

Application Tracking - Save Money on Unused Software

Did you know that underutilized software cost businesses a staggering $34 billion per year? Monitoring employee application usage allows you to track the utilization rate of software so you can avoid paying for software that isn’t being used.

What CurrentWare’s Remote Desktop Monitoring Software Tracks

laptop with currentware's remote employee monitoring software on screen

CurrentWare audits user activity on local or cloud-based desktop computers, virtual machines (VMs), and servers running the Windows operating system. 

When monitoring and managing your end-users in Citrix with CurrentWare you can track and control computer activities with PC Mode to manage the individual virtual machine or with User Mode to track and control the activities of specific users across multiple devices and/or virtual machines.

Monitoring and managing your end-users with CurrentWare in a Terminal Services environment works similarly. The exception is that in a Terminal Server/Terminal Services environment the server will be registered as an individual endpoint; when you run a report from PC mode it will give you a report on all the users’ profiles in a single report.

For monitoring RDP sessions CurrentWare meets your company’s monitoring and auditing needs for Windows desktop and Windows Server by tracking both local and RDP user sessions on all endpoints.

The CurrentWare Suite provides dozens of remote desktop activity reports for auditing how end-users interact with endpoint devices. 

These reports include

  • User logon session duration
  • Internet activity reports (search queries, bandwidth consumption, sites visited, browsing time)
  • Application usage reports
  • Active vs idle time tracking
  • USB file operations reports (files copied/created/deleted/renamed to portable storage)

Many of these reports can be configured as alerts to notify you when specific actions occur on monitored endpoints. 

In addition to remote user activity reports, the CurrentWare Suite includes solutions for peripheral device control, web content filtering, and remote PC power management

Track Remote Employee Work Hours (Audit Logon Events)

Tracking user activity on a daily and weekly basis allows you to correlate time spent working remotely with the hours that employees self-report.

Using enPowerManager’s User Logon History report you can audit logon events on remote computers.

enpowermanager's user logon history report with timestamps of when employees log in and out each day

This report shows you

  • The user that logged in (local or domain)
  • Which users connected to a certain server or computer and when
  • Their logon time and date
  • Their logoff time and date
  • The duration of their logon session (logon-logoff time)

enPowerManager also includes a Startup and Shutdown History report to track each time a remote user alters the power state of their computer or the computer that they remotely connect to.

enpowermanager startup and shutdown history report

This report shows you

  • Startup Events
  • Sleep/Shutdown Events
  • Hibernate/Standby Events

Using these reports you can track how long users have been connected to their local computers, remote workstations, and/or virtual machines. 

This allows you to

  • Verify that employees are starting and stopping their work days at expected times.
  • Audit remote connections for off-hours access (potential insider threat risk)
  • Compare logon times to BrowseReporter’s computer activity reports to see how they spend their time during work hours

To prevent users from simply logging into their workstation via remote desktop, leaving for the day, and logging in at the end of the workday, you can track idle time with BrowseReporter. BrowseReporter’s time tracking features will show you whether the employee was actively using their computer during the day.

Remote Employee Productivity

Using BrowseReporter’s user activity reports you can monitor RDP sessions of your employees to track their productivity levels. BrowseReporter audits the internet and application usage of users that connect to remote computers using remote desktop and similar technologies.

If you have employees who work from home you can use the activity reports to verify that they were productive during work hours. 

BrowseReporter even includes a pre-built employee productivity report that provides a high-level overview of how much time your remote employees spend on websites that are productive, unproductive, or neutral. These classifications can be customized to match what is considered productive for your employees.

You can even use the productivity by location report to compare productivity levels between time spent in-office vs time spent working remotely. This report tracks how much time was spent working from IP addresses that are associated with your local network and how much time was spent working from other IP addresses.  

BrowseReporter's work from home employee productivity report
BrowseReporter’s productivity by location report

Internet and Application Usage

Monitoring internet and application usage is essential for ensuring that your remote users are in compliance with acceptable use policies.

When your remote users browse the internet or use Windows applications, their activity data will be collected by the CurrentWare client. 

Samples of BrowseReporter’s computer activity reports

Employee productivity overview dashboard from BrowseReporter's data dashboard
Top 5 Productive vs Unproductive Groups
BrowseReporter specific application usage dashboard
Specific Application Usage
Web Activity Dashboard
BrowseReporter internet bandwidth usage dashboard
Bandwidth Usage Dashboard
Top 5 Websites and Applications
BrowseReporter Keywords Searched by Time report with 9 different keywords listed.
Search Queries Report

Bandwidth Consumption

Reducing bandwidth consumption is critical if you have several remote users connecting to your network over a VPN. Excessive bandwidth use will severely impact latency and reduce the reliability of the remote session. 

BrowseReporter’s bandwidth usage reports identify the websites that consume the most bandwidth. If unproductive websites are becoming a bandwidth hog in your network you can use BrowseControl’s web filtering features to block them.

Active vs Idle Time

Two bar charts with employee computer usage data: top 5 active time and top 5 idle time

BrowseReporter measures the Idle Time of remote users to see how long they are away from their computers. Using the email alerts feature you can get notified when an employee is away from their computer for a predetermined period of time.

The distinction between Active Time and Idle Time is based on the end-user’s mouse and keyboard activity. When there is no input from their mouse or keyboard for a designated period of time, BrowseReporter will shift tracking from Active Time to Idle Time.

By default, the amount of time that the end-user must be inactive before BrowseReporter switches from Active Time to Idle Time is 20 minutes. This threshold can be customized to better suit your environment.

BrowseReporter's idle time tracking limit setting

BrowseReporter’s integrated system idle time tracker sorts remote user activity into three categories based on their usage:

  • Active Time is how long the employee was actively using their computer. A computer is considered active when mouse and keyboard inputs are detected.
  • Idle Time is how long a given website was left open but was not actively being used.
  • Total Time is the full length of time that a given websites was open (active time + idle time)

Learn More: Track the Idle Time of Employees 

Audit File Transfers to Portable Storage Devices

With AccessPatrol’s device control features you can prevent data exfiltration when employees work from home. 

With the CurrentWare Client installed on the devices you would like to monitor you can detect when USB devices are plugged into domain controllers, servers, or workstations. 

You can also configure alerts that notify you when files are transferred to portable storage devices or when certain peripheral devices are inserted into monitored endpoints.

Sample USB Device Reports

File Operations

AccessPatrol USB file operations report
Hourly graph of USB file operations

Allowed vs Denied USB Devices History

Graph of an hourly timeline showing blocked vs allowed USB devices
AccessPatrol Allowed vs Denied report with 13 different devices listed.
All Peripheral Devices Report – Allowed vs Denied Devices

How Remote Desktop Monitoring Software Works

CurrentWare console main screen with AccessPatrol, BrowseControl, BrowseReporter, and enPowerManager

CurrentWare’s remote desktop monitoring software is supported on local or cloud based desktop computers, virtual machines (VMs) and servers running the Windows operating system. 

So long as the underlying operating system is a version of Windows that is supported by CurrentWare, your remote users can be monitored. 

This means that you can audit user activity on Desktop as a Service (DaaS) providers such as Amazon Workspaces and Citrix, self-hosted Virtual Desktop Infrastructure (VDI), or standard endpoints that are being accessed through remote desktop, DirectAccess, or a VPN. 

All CurrentWare components are compatible with Remote Desktop Services (RDS) or Terminal Servers (TS). If you have users remotely connecting to a terminal server or a Remote Desktop service, you can use CurrentWare’s remote desktop monitoring software to control and track their computer activity.

Learn more about monitoring user activity in Citrix with CurrentWare

CurrentWare is known to be compatible with the following virtual machines:

  • VMware
  • Parallels
  • VirtualBox
  • Oracle VM
  • Virtual-PC
  • Hyper-V

Remote Monitoring Software Agent

Screenshot of the CurrentWare installation window

CurrentWare’s remote desktop monitoring software tracks the computer activity of remote users using a software agent that is installed on each endpoint that you would like to monitor. The CurrentWare client agent is responsible for receiving the policies from your CurrentWare server and triggering them locally on the remote computer.

The client agent is able to differentiate between each user that is logged into the remote desktop servers. This allows you to apply unique security policies for different groups of endpoints or users. You can separate your users/endpoints into logical groupings and run reports on their computer activities. 

  • Integrity: The Windows user activity monitoring software offered by CurrentWare is protected from any end-user attempts to stop or uninstall the agent.
  • Connectivity: The CurrentWare Suite includes continuous Windows desktop and Windows Server employee monitoring software. Even if the connection to the CurrentWare Server is temporarily lost, the CurrentWare Client will continue to monitor the user’s during their RDP and local sessions. The user activity data will be stored locally until a connection to the server is re-established.
  • Visibility: The CurrentWare Client can be deployed in stealth mode or with optional privacy-enhancing features enabled. 
Get My Free Trial
Chat With CurrentWare

Monitoring Local vs Remote Devices

Employee monitoring: How to Monitor Remote Workers - CurrentWare

How you will deploy CurrentWare’s remote desktop monitoring software depends entirely on the needs of your environment.

If you would like to monitor the desktops that the end-users remotely connect to, you will install the CurrentWare client on that endpoint/virtual machine, or use terminal services to provide the remote employee with a desktop that has the CurrentWare client installed.

If you would like to remotely monitor the end-user’s computer, you will need to install the CurrentWare Client on their computer. To reduce potential privacy concerns the best practice is to provide the remote user with a company-owned device and have them sign a written notice that alerts them of the monitoring.

Learn More:

Remote Desktop Monitoring Software FAQ

1) Can Remote Desktop (RDP) Be Monitored?

Yes. Using CurrentWare’s remote desktop monitoring software you can monitor the computer activities of your end-users. This includes logon/logoff events, internet history, and application usage. Alongside monitoring remote desktop protocol (RDP) sessions  the monitoring software can also track activities on local sessions.

2) How Do I Monitor Remote Desktop Activity?

You can start monitoring remote desktop activity by downloading a free trial of CurrentWare’s remote desktop monitoring software and following these installation instructions.

3) How Do I Monitor Remote Users?

Remote users can be monitored with a few different methods

  1. Installing monitoring software on a computer or virtual desktop that they remotely connect to over VPN, RDP, or other remote access method.
  2. Installing monitoring software on the workstation that they use to work from home

So long as the monitoring software agent is installed on the device you would like to monitor and the agent has a connection to a database, you can monitor your remote users.

The types of data that you collect when monitoring remote users depends on the remote employee monitoring software that you use. CurrentWare’s monitoring software solutions allow you to track websites visited, applications used, productivity levels, logon/logoff times, and more.

4) Does CurrentWare’s Remote Desktop Monitoring Software Support Citrix?

Yes, CurrentWare is supported on Citrix. You can install the CurrentWare Clients on your Citrix Workspace so long as they are running compatible versions of Windows. | Learn More

Get My Free Trial

Ready to start monitoring remote desktop sessions? Get started today with a FREE trial of CurrentWare’s remote desktop monitoring software solutions.

Need help getting started? Our technical support team is here to assist you through your evaluation over phone, live chat, or email.

Sai Kit Chu
Sai Kit Chu
Sai Kit Chu is a Product Manager with CurrentWare. He enjoys helping businesses improve their employee productivity & data loss prevention efforts through the deployment of the CurrentWare solutions.

Related posts

February 24, 2023

How to Manage Users & PCs in the CurrentWare Suite

Read more
en power manager remote pc power manager and logon tracker
February 24, 2023

How to Use enPowerManager—PC Power Manager & Employee Login Tracker

Read more