How to Detect Employee Monitoring Software on Your Work Computer

Employee monitoring software is an agent installed on a work device that records activity — time worked, applications and websites used, and often periodic screenshots — and sends it to a dashboard your employer can see. It is also called employee tracking software, user activity monitoring, or productivity monitoring. To check whether it is running on your machine, look in four places: your running processes, your installed applications, your startup items, and your browser extensions. On a Mac, the privacy permissions screen is faster than all four.

Before you start, one thing is worth knowing: on a company-managed device, none of these checks is conclusive. Monitoring agents are usually installed with administrator rights and allowed through security software by the same IT team that deployed them. This article covers where to look, what each check does and does not prove, what your employer is legally required to tell you, and what to do with the answer.

Key takeaways

• Four places to check on Windows: Task Manager, installed programs, startup items, browser extensions. On macOS, Privacy & Security permissions show you more in thirty seconds than any of them.
• No check is conclusive without administrator rights, and most employees do not have them on a work device.
• A company-issued laptop enrolled by IT almost certainly has some form of management software on it. That is the starting assumption, not the exception.
• Most US employers are legally allowed to monitor devices they own. Three states require them to tell you first, and Connecticut’s rules change on 1 October 2026.
• Do not uninstall or disable anything you find. Ask instead — it is faster, and it does not put your job at risk.

What Employee Monitoring Software Collects

Most workplace monitoring records the shape of your work rather than its content: hours worked, active and idle time, which applications and websites were open, and on many platforms a screenshot every few minutes. Responsible tools stop there. What they collect, and what they leave alone, is a configuration choice your employer makes.

The second column is not a legal guarantee. It describes how mainstream employee monitoring software is normally configured, and the gap between that norm and what your employer actually switched on is exactly what the rest of this article helps you find out.

How to Check a Windows Computer

Open Task Manager with Ctrl + Shift + Esc and read the Background processes list, then check Startup apps in the same window. Follow with Settings, Apps, Installed apps, and finally your browser’s extensions page. Four places, about ten minutes. Write down anything you do not recognise rather than acting on it.

Running processes

Press Ctrl + Shift + Esc, select More details if you get the compact view, and open the Processes tab. Read the Background processes section rather than the apps you opened yourself. Right-click anything unfamiliar and choose Open file location to see where it was installed from, then search the name before drawing conclusions.

Monitoring agents tend to have unremarkable names — something with Agent, Service, Helper or Client in it — and they run continuously rather than when you launch them.

Startup items

In Task Manager, open the Startup apps tab. A monitoring agent has to start when you log in, so it will be here unless it is registered as a system service. Anything enabled at startup that you did not install yourself is worth writing down.

Installed applications

Open Settings, then Apps, then Installed apps, and sort by install date. Two things are informative: software you do not recognise, and a cluster of items installed on the same day your laptop was issued. The second pattern usually means the machine was imaged by IT before it reached you.

Browser extensions

Some monitoring works through the browser rather than the operating system. Open your extensions page — chrome://extensions in Chrome, edge://extensions in Edge — and look for extensions you did not add, particularly ones that can read data on all websites. Extensions installed by policy usually cannot be removed and are labelled as managed by your organisation.

How to Check a Mac

On macOS, start with System Settings, Privacy & Security, and read the Screen Recording and Accessibility lists. Any application allowed there can capture your screen or observe your keyboard and mouse. This single screen tells you more than a process list, and it takes under a minute.

The Device Management entry is the one most people miss. If it exists, your Mac was enrolled by your employer before you received it, and IT can install software on it without asking you each time. That alone does not tell you what is installed — but it tells you the mechanism is there.

What Each Check Proves, and What It Misses

Every method above has a ceiling. Most need administrator rights you probably do not have on a work device, and monitoring agents are typically allowed through the same antivirus your company installed. Finding nothing is not evidence that nothing is running.

Two practical consequences. Running an unapproved scanner on a work device can itself trigger an alert in your company’s security system, which draws precisely the attention you were trying to avoid. And on a managed corporate network, outbound traffic is often routed centrally, so a traffic analyser shows you the company gateway rather than the agent. If what you have found is a screenshot-based tool, screenshot-based monitoring done without being intrusive sets out what a reasonable configuration looks like.

Signs That Need No Technical Check at All

Some indicators are more reliable than anything in Task Manager. If your employer discusses active time, productivity scores or attendance logs that nobody submitted manually, an agent is producing them. If you have ever received an idle prompt asking whether you are still working, the same applies.

• You were asked to install a time-tracking app. Many of them record far more than hours.
• Your manager cites specifics nobody reported. How long a document stayed open, when you stepped away, which tool you spent the morning in.
• You get inactivity prompts. These are generated by an agent watching keyboard and mouse input.
• The laptop was configured before it reached you. Pre-imaged and enrolled devices almost always carry management software.
• You signed an acceptable use or IT policy at onboarding. Look for the words monitoring, tracking, recording or surveillance. In most cases, disclosure was made — just not prominently.
• Access to settings has narrowed. Losing the ability to install software or reach system preferences usually means a stricter management profile was applied.

Does Your Employer Have to Tell You?

In the United States, no federal law prohibits an employer from monitoring devices it owns, and the Electronic Communications Privacy Act permits monitoring for legitimate business purposes. A small number of states go further and require notice before monitoring begins. Which rules apply depends on where you work, not where the company is headquartered.

This table is not exhaustive. Other states impose related requirements — on recording audio, on biometric data, on personal devices — and the list of states with notice obligations is still growing. If the question matters to your situation, check your own state rather than relying on a summary.

Two points worth holding onto. First, a policy buried in an onboarding pack still counts as disclosure in most places, which is why the employee handbook is the first document to reread. Second, employees outside the US often have stronger protections: under GDPR rules for employee monitoring, employers must inform staff before monitoring starts and limit it to what a legitimate purpose requires.

Get more out of your business.
Start Your 10-Day Trial

What to Do If You Find Something

Do not uninstall, disable or block it. Removing monitoring software from a company-owned device is likely to breach your employment contract or IT policy, and it converts a question about privacy into a disciplinary matter. Read your policy documents first, then ask.

• Reread what you signed. Employment contract, handbook, IT acceptable use policy. Most people who discover monitoring find it was disclosed in one of them.
• Ask plainly rather than accusingly. “I noticed [name] running on my laptop — what does it collect?” is a reasonable question and is answered clearly by employers with nothing to hide.
• Separate personal from work. The strongest protection is not detection but habit: personal banking, private messages and personal accounts belong on your own device. On company hardware, the expectation of privacy is limited even where monitoring is undisclosed.
• Check your state’s requirements if you were never told anything. Where notice is required and none was given, your employer may be out of compliance.
• Talk to an employment attorney if the monitoring reaches personal devices, continues outside working hours, or looks targeted at you specifically.

Questions worth asking your employer

These get you further than any technical check, and asking them is not confrontational — it is asking for clarity.

1. What is being recorded: applications, websites, screenshots, active time, keystrokes?
2. Is anything excluded — personal accounts, particular applications, breaks?
3. Can I see my own data?
4. Who else can see it, and does it feed into performance reviews?
5. Is it running all the time, or only during scheduled hours?
6. How long is the data kept, and how is it secured?

If You Are the One Deciding Whether to Monitor

Some readers arrive here from the other side of the question. The short version: disclosed monitoring achieves what covert monitoring achieves, without the legal exposure and without the damage to trust that follows when people find out on their own.

Tell people what is collected before the agent is installed, keep collection to work hours and work activity, and give employees access to their own data. Monitask records time worked, activity levels, applications and websites, and periodic screenshots while an employee is clocked in — with no keystroke logging, and with screenshots and internet tracking switchable per person. A stealth mode exists for the narrow cases where it is legally warranted, but it is not the default, and it does not remove any notice obligation your state imposes. Where you employ people determines what you must disclose; the software does not decide that for you.

If the underlying goal is proof of hours rather than surveillance, clock-in and clock-out tracking usually answers it with far less collected data. And on distributed teams, building trust remotely tends to solve the problem that monitoring was bought to solve.

> This article is general information, not legal advice. Employee monitoring requirements vary by state, by locality and by contract, and they change — Connecticut’s rules are replaced on 1 October 2026. For your own situation, consult an employment attorney in your state.

Reliable employee tracking software. Clear visibility and insights into how employees work. Even remotely.
Try Monitask free for 10 days