I just want advice on monitoring employees that are working from home. Does anyone use any specific software or methods that they would recommend? Remote user reporting from the server is not detailed enough.
13 Spice ups
as an employee who is starting to work from home one day a week, I highly suggest you talk with the remote workforce and specify the measurable work you want to see accomplished. Projects have timelines that are easy enough to measure. Responsiveness to communication is easy enough to measure… Make your expectations clear.
2 Spice ups
What are they accessing and what do you want to know about it?
They are accessing their pc’s remotely, and I’m tempted to put a spy like software on one of the pc’s in particular. I can see when they are logged into our main database, but it doesn’t mean they are actually using it. They could just be logged in and leaving it up.
The real answer for this is like Andrew8292 said, it’s all about measurable work. You don’t REALLY care if they’re sitting in a database program not using it - you REALLY care about how much they are accomplishing. It’s like office Internet use - if you have a user who cranks out 200% of the work of his/her peers, do you really care about their Facebook usage as long as they’re not breaking actual laws?
1 Spice up
You could look at using Ultra VNC. There are a few scripts/how-to’s on Spiceworks that can make deployment much easier.
The other thing to consider, according to many studies, is the social side of the equation. Some individuals thrive in this environment; others find it difficult to operate long-term with less interaction with fellow employees. Some progress has been made with technology with messaging and VTC, so this is an area to evaluate for long-term success for both the employer and the employee.
Edit: sorry about off post. I know you specifically wanted monitoring. If these are company owned PC, you might want to look at snoopstick. Does monitoring and screen captures periodically, and logs Internet activity. It then dumps it to homebase.
1 Spice up
We use GotoManage by Citrix, with this we can do remote support and I can see the screen of any computer/server in the domain or off of the domain regardless of who is logged in. This is how I work remotely from my personal computer at home that’s not joined to the domain and I’m not using vpn.
http://gotomanage.com/
You could purchase licenses for just the machines that will be working remotely and make an “Acceptable Usage Monitor” that grants you the right to monitor it at any time for work purposes.
Depending on the database you’re keeping an eye on, perhaps simply activity logs of that specific user name? I don’t know what the program is you’re administering, but there’s very likely some log capability in the software or the database backend (like SQL).
Thank you! Part of the problem is that I don’t want to have to babysit and constantly check in to making sure they are working, since that will take away from my own work. They have kind of left me no choice at this point because there is already abuse of leave time etc that I am trying to stay on top of. I will probably take Denis’ advice and try snoopstick. I’m just always wary of trying those things. I appreciate everyone’s input!
I can’t remember which one I used to use, but I ran a program that was designed for parents to keep track of what their kids were doing on the computer. It even had a keystroke logger that you could specify a network location to write to. With the timestamps, I could just check it at my leisure and determine when the user was “active” and what they were typing.
However, this was sanctioned, nay requested, by HR. I wouldn’t have done it without their consent and wouldn’t recommend anyone else to do it, either. Employees not doing their job should be a management/HR problem, not an IT problem.
1 Spice up
The owners of my company are a bit paranoid, and we use a program called Spector360 to log just about everything employees do. Other than an NP Pool leak issue we got resolved, I don’t notice any impact on PC performance.
That works well for multiple PCs, if you only need to monitor this one PC Spector Pro would probably get the job done.
Spector360 is a great program for monitoring employee activity. I’ve set it up for a bunch of people in the past, works really well. Small foot print, undetectable to the user, has keystroke logging, keyword alerts, screenshots, etc.
MoCoRo wrote:
They are accessing their pc’s remotely, and I’m tempted to put a spy like software on one of the pc’s in particular. I can see when they are logged into our main database, but it doesn’t mean they are actually using it. They could just be logged in and leaving it up.
Well, what is it tha tyou want to know? How do you define “working”? Is it being productive or is it doing specific tasks? For most companies, it is “getting work done” and can’t be monitored, ever, through a computer like that. This is a VERY murky area you are getting into and it can bite you quite significantly.
1 Spice up
afeitguy wrote:
However, this was sanctioned, nay requested, by HR. I wouldn’t have done it without their consent and wouldn’t recommend anyone else to do it, either. Employees not doing their job should be a management/HR problem, not an IT problem.
I wouldn’t even think of doing it for HR. Unless the legal department okay’d it, gave me indemnification AND my own attorney cleared it I wouldn’t even consider taking on that liability. We are talking jail time here. Huge crime if done wrong. I’d probably just quit any company that asked me to do it, legal or no.
2 Spice ups
Scott Alan Miller wrote:
I remember doing it with extreme apprehension and basically told them, “I’d like the record to state I’m not comfortable with this and would prefer not to.” They placed my statement in my company file. They had it okay’d by the legal department, but I still wanted something in writing. Their “okay” was based on a form every new employee signs and every time they logged in to their computers, they had to click “ok” on a legal message. Whether that would have saved me personally, I don’t know.
As you said, very murky waters.
afeitguy wrote:
Scott Alan Miller wrote:
I remember doing it with extreme apprehension and basically told them, “I’d like the record to state I’m not comfortable with this and would prefer not to.” They placed my statement in my company file. They had it okay’d by the legal department, but I still wanted something in writing. Their “okay” was based on a form every new employee signs and every time they logged in to their computers, they had to click “ok” on a legal message. Whether that would have saved me personally, I don’t know.
As you said, very murky waters.
99% chance you are fine. But any company that asks me to take a 1% chance on a huge jail sentence isn’t a company I’ll do work for.
As far as I know… no contacts will protect you from a keylogger in a jurisdiction that doesn’t allow them. It is considered, in some locations, a hacking attack on the user’s banking information (in most cases, because they access their bank) and whether they are allowed to do so or not, intentionally grabbing their passwords could land someone in jail under hacking laws - possibly without trial.
The US takes hacking pretty seriously (and the law pretty loosely) - not a good combination.
I have dual roles here, so I am management, and I don’t mind doing it. Like I said, rules are bent frequently by employees so I’m more than happy to babysit. I come in every day to do my job, so others should be getting paid to work too.
And this is very dependent on industry too. If you are in medical or finance, a keylogger WILL send everyone involved to jail. If they did this where I work and picked up my passwords someone would certainly be spending a very uncomfortable night in an FBI office.
Also, even if a keylogger gets approved - ANY activity from that user’s accounts cannot be claimed to be them in court. It could be anyone who has access to the keylogger. It shifts ALL responsibility for the actions on those accounts that are compromised to the departments picking up those keylogger records. Now this is where it REALLY gets murky.
Since keyloggers effectively remove anyway to prove who took what action AND demonstrate that there was an intentional decision made to do so, the liability shifts almost entirely to IT and management for things that may be quite unforeseen.
Imagine a really pissed off worker who knows that a keylogger was installed on their machine and has reason to believe that they are being watched. They could surf somewhere illegal, pick up some child porn and immediately call the FBI and report that they believe that their IT department was surging child porn from their computer in order to frame them.
Sure, you didn’t do anything. But how do you prove that? You forcibly took their identity via a keylogger and assumed all legal responsibility for their actions under those credentials. The FBI will find the keylogger and there is pretty much no defense at that point other than claiming that the employee is framing you - but the employee has the defense of 1) not knowing the keylogger was there and 2) that you took a questionable legal action first, not them.
Not a scenario I’d like to try to defend.
MoCoRo wrote:
I have dual roles here, so I am management, and I don’t mind doing it. Like I said, rules are bent frequently by employees so I’m more than happy to babysit. I come in every day to do my job, so others should be getting paid to work too.
Define “working” though. Is thinking about a problem or researching it working? Would you be happy if you were only considered to be working when you used certain tools or typed certain things but not when trying to solve a hard problem, talking to your boss, training someone, reading company material, etc.?
Using physical use metrics to define “working” is a very tough thing to do and will, if people know about it, cause “gaming” rather than “working” since there is practically no way that actual work will look as good as pretending to work does.
1 Spice up
