Work laptop activity: what Windows logs show vs what needs an agent

Part of our guide on choose a laptop

Most work laptops already log app use and web visits for free — you just have to know where to look.

What you need to check work laptop activity

Say you manage five company laptops and want a weekly view of app use and web time without buying anything yet. You can get that from tools already on Windows and in Microsoft 365 or Google Workspace if the devices are company-owned and enrolled.

Picture a new starter signing the handbook on day one. That signature, plus the laptop being joined to your Microsoft Entra ID or Google Admin, is what lets you pull logs later without chasing the device.

You need admin access to collect anything useful. Without it you see only the local user view, and that view misses sign-ins, installs and browser history synced to the work account.

Start with what is free and reversible. Add an agent only when you need real-time alerts or scheduled limits that the OS does not provide. Before you commit to anything, it is worth looking at set limits on kids laptop.

• Admin account: Microsoft 365 admin center or Google Admin console, plus local admin on the laptop
• Device state: joined to Entra ID / Workspace and showing as compliant in Intune or Google endpoint management
• Log access: Event Viewer on Windows, Microsoft Purview audit log or Google Admin Reports
• Policy docs: acceptable use and monitoring notice signed by the employee
• Optional agent: SentryPC or similar for central time limits and alerts when free logs are not enough

Consent and disclosure come before any monitoring

Say you install a tracker on a Friday and tell staff on Monday. Even on a company laptop that gap creates legal risk and it breaks trust fast.

Most regions require prior written notice that explains what you collect, why, and how long you keep it. The notice must be given before monitoring starts, not buried in a handbook after the fact.

Cover these points in plain language: which data you collect (app names, URLs, active time), what you do not collect, who can view reports, and the retention window in days. Keep the policy short and signed. If that sounds like your situation, read up on webcam problem after windows update next.

For BYOD or remote work in the EU, UK, California and several other states, consent rules are stricter. Limit monitoring to the work account or work profile, avoid personal browsing and personal apps, and get separate consent for any screen or keystroke capture. When in doubt check local law before you deploy.

What Windows, macOS and Microsoft 365 already log for free

Say you want to know if Teams, Chrome and Excel were used yesterday and for how long. Windows and your cloud suite already record that without extra software.

On Windows, Event Viewer and Task Manager show app starts, crashes and active time in hours per app when you review the last 7 days. On macOS, Screen Time and Console logs give similar app use, and battery or power logs hint at active periods. Both depend on the user being signed into the work account and the device being online. It helps to understand how to add gadgets on desktop before going further.

Microsoft 365 keeps a unified audit log in Microsoft Purview that records file access, Teams messages, SharePoint edits and sign-ins for 90 days by default on business plans, longer on E5 or with retention policies. Google Workspace has Reports and Audit for logins, Drive edits and Chrome history if Chrome is managed.

Browser history itself lives on the device and in the managed browser profile. If you manage Chrome or Edge via policy, you can pull visited URLs centrally; if not, you need the local profile or an agent. Free logs rarely give second-by-second idle vs active time, and they do not capture screen content.

• Windows: Event Viewer > Applications and Services Logs, plus Settings > System > Screen Time style app history
• macOS: System Settings > Screen Time > App Usage, plus Console for system events
• Microsoft 365: Purview > Audit search for app and file activity, Entra sign-in logs for active time
• Google: Admin console > Reporting > Audit and investigation, plus managed Chrome history

MDM vs employee monitoring agent: what each can and cannot see

Picture two tools on the same laptop: Intune as MDM and a monitoring agent. One checks health, the other watches use, and they do not overlap as much as vendors suggest. The other half of this decision is fitting gadgets to your desk.

An MDM like Microsoft Intune or Google Endpoint Management enforces policy. It sees inventory, OS version, encryption status, installed apps and compliance, and it can wipe the work profile. It does not see keystrokes, screen content or time per website unless the browser is separately managed.

An employee monitoring agent runs as a background service and logs active time in minutes, app switches, URLs and idle periods, with reports by user and device from a cloud console. It can filter sites and set time limits. It cannot fix compliance or push OS updates like an MDM does.

Choose by question. If the question is "is the device safe and up to date" use MDM. If the question is "which apps and sites were used and for how long" use either managed browser logs or an agent. Many small teams use MDM plus managed browser logs and skip screen capture entirely. We cover usb c charger for laptop will it charge at 65w in its own article.

How to see what employees do on work laptops without screen capture

Say you need weekly proof of app use and web time for a small team, but you do not want screenshots. You can pull this from OS and cloud logs, or let an agent collect it centrally in one report.

For many teams SentryPC handles this part without screen capture by logging app use, visited sites and active time in minutes from a cloud console with filtering and time limits, while running in stealth if your policy allows it. It does not replace MDM for compliance and it still needs prior notice and consent, and it does not fix OS updates. If you prefer free methods, the steps below get you most of the way.

A quick analogy helps. Think of logs like a library checkout list. You see which books were borrowed and when, not what page the reader stared at. That is enough to spot patterns without reading over a shoulder.

Use the same 90 days window and the same work accounts for every check, so comparisons stay fair. Export to CSV and keep reports for the retention period you stated in your policy.

1. Confirm disclosure is signed and the laptop is joined to Entra ID or Google Admin and shows compliant.
2. In Microsoft 365 open Purview > Audit > Search, filter by user and date, and export app and file activity; in Google open Admin > Reports > Audit.
3. On Windows open Event Viewer > Applications and Services Logs > Microsoft > Windows > AppModel, and check app start events; on macOS check Screen Time > App Usage for the same period.
4. For web use, pull managed browser history from Intune/Chrome policy or from the browser profile on the device, then group by domain and count visits and duration.
5. For active time, add Entra sign-in times plus app event gaps with an idle timeout of 5 to 10 minutes; time with no input beyond that counts as idle.
6. Save the CSV, note the date range and keep it only for the retention window you disclosed.

Common mistakes that break workplace privacy rules

Say a manager quietly installs monitoring to catch one person. The team finds out, trust drops, and the data may be unusable if notice was missing.

The fix is process, not more tech. Write a short monitoring policy, have each employee sign it, limit scope to work accounts and work hours, and review access to reports every quarter.

Keep data for the retention window you promised, then delete it. Store reports with access limited to HR and IT, and log who viewed them. That last part matters if you ever need to explain use.

If you use an agent, test its filter and time rules on one device first. Block the wrong category and you block work. Start permissive, then tighten.

• Mistake: starting logging before notice -> Do instead: circulate policy, collect signatures, then enable logging
• Mistake: capturing personal profiles or personal Chrome -> Do instead: monitor only the managed work profile or work browser
• Mistake: keeping logs forever -> Do instead: set a retention window in days and auto-delete after it
• Mistake: letting every manager see everything -> Do instead: restrict report access and keep an access log
• Mistake: using screen or keystroke capture for time tracking -> Do instead: use app and URL time, add screen only with separate consent if truly needed

Questions people still ask

I have set up both MDM and agents for small teams and kept the free logs as the first check before adding anything heavier.