How do you monitor the activities of employees working from home?

For employees who are working form home, keeping track of their activities enables organizations to improve business productivity.

Review your employee work hours Free, fully functional 30-day trial
  • With Native AD Auditing

  • With ADAudit Plus

ADAudit Plus is a comprehensive Active Directory auditing solution that will help you monitor, and keep a track of all remote logons and logoffs of your domain users. It will also track events like network disruptions. Using ADAudit Plus, you can track your employees' productivity, who work from home, with intuitive reports.

You can configure these reports to be automatically generated and emailed to you at specified intervals. You can also export these reports to a format of your choice. Here is how you can generate the employee work hour report using ADAudit Plus:

Login to ADAudit Plus → Go to the Reports tab → Under Local Logon-Logoff Reports → navigate to the User Work Hours report

  • user-work-hours
    • The details you can get in this report are:
      1. Employee name
      2. The date when the logon or logoff occurred
      3. The computer or server in which the logon or logoff occurred
      4. The time at which the first logon occurred
      5. The time of the last logoff
      6. The total hours (calculated using the last logoff time and the first logon time)
      7. Active hours (the amount of time the employee was actively logged in)
      8. Idle hours (the amount of time the employee was not actively logged in)
    Clicking on 'TOTAL HRS' gives you a break-up of all the underlying logon and logoff times for the particular day. user-active-hours
  • You can also generate reports to track the access of resources on servers. Here is how you can do it using ADAudit Plus:

    Login to ADAudit Plus → Go to the File Audit tab → Under File Audit Reports→ navigate to All File or Folder Changes.

    tracking-all-files
    • The details you can get in this report are:
      1. Server name
      2. File/Folder name
      3. The location of the file/folder
      4. The time at which the first logon occurred
      5. The name of the user who accessed the file
      6. The action done by the user
      7. The name of the client machine used to access the file/folder

    With these reports, you can track the actual work hours of your employees even when they are working from home. This could in turn help you in making decisions about your business productivity.

With native AD auditing, here is how you can monitor work hours of employees working from home:

  • Step 1: Enable 'Audit logon events' policy
  • Launch Server Manager in your Windows Server instance.

  • Under Manage, select Group Policy Management and launch the Group Policy Management console.

  • Navigate to Forest --> Domain --> Your domain --> Domain Controllers.

  • Create a new GPO and link it to the domain containing the user object, or edit any existing GPO that is linked to the domain to launch the Group Policy Management Editor.

  • Navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy.

  • Under Audit Policy, select Audit logon events and turn auditing on for both success and failure.

  • Step 2: Edit auditing entry in the respective file/folder
  • Now, navigate to Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Logon/Logoff.

  • Under Logon/Logoff, turn on auditing for Audit Logoff, Audit Logon, and Audit Special Logon, for both successes and failures.

  • Step 3: Track employee work hours in Event Viewer

    Every time a user logs on, logs off, ends a session, locks a system, or unlocks a system, an event log will be recorded in the Event Viewer. These event logs can be used to track employee work hours. To view these audit logs, go to the Event Viewer. Under Windows Logs, select Security. You can find all the audit logs in the middle pane as displayed below.

  • To filter the event logs to view just the logs associated with employee work hours, select Filter Current Log from the right pane. Simply search for the event IDs 4624 (account was logged on), 4647 (account was logged off), 4634 (logon session end time), 4800 (system was locked), and 4801 (system was unlocked). You can see who logged on, when they logged on, when they logged off, and when the system was locked and unlocked.

  • Step 4: Track Remote Desktop activity
  • Employees who work from home require remote access to the organization's network and resources. Every time a user sets up a remote connection, authenticates, logs on to a session, and launches Explorer Shell successfully, an Event Log will be recorded in the Event Viewer. To view these audit logs, go to the Event Viewer. Under Windows Logs, select Security. You can find all the audit logs in the middle pane as displayed below.

  • To filter the event logs to view just the logs associated with the remote access of the organization's network for employees who are working from home, select 'Filter Current Log' from the right pane. Simply search for the event IDs 1149 (Remote Desktop Services: user authentication succeeded), 4624 (an account successfully logged on), 4625 (an account failed to log on), 21 (Remote Desktop Services: session logon succeeded), and 22 (Remote Desktop Services: Shell start notification received). You can see the establishment of a network connection to a server from a user RDP client, whether an RDP user has been successfully authenticated on the server or not, whether a local logon is successful, and a successful Explorer Shell start.

    Using this information, the productivity of an employee productivity working from home can be computed. You will need to repeat this multiple times if you want to compute the work hours of multiple users.

Native auditing becoming a little too much?

Simplify remote logon activity auditing and reporting with ADAudit Plus.

Get Your Free Trial Fully functional 30-day trial

Related How-tos

Request Support

Thanks

One of our solution experts will get in touch with you shortly.

    Please enter business email address
  •  
     
  • By clicking 'Send Request', you agree to processing of personal data according to the Privacy Policy.

© 2019 Zoho Corp. All rights reserved.