How to Detect Employee Monitoring Software
Reviewed for accuracy by Tarun Kumar Reddy on October 14, 2026.
Most employee monitoring is not hidden. It runs as a named application, it appears in the list of installed software, and it was mentioned in a policy somebody signed on their first day. Finding it is usually a matter of knowing which four places to look rather than running anything clever.
This page covers how to detect employee monitoring software on a Windows or Mac machine, what each finding actually means, and what your rights are once you know. It deliberately does not cover disabling or evading monitoring, because on an employer owned device that is normally a policy violation and it replaces a question you can ask openly with one you cannot.
Start with the assumption, then check it
On a device your employer owns, assume the capability exists. Nearly every corporate laptop is enrolled in a device management platform, and enrollment alone gives an administrator the ability to inventory software, push new software, read configuration, and locate the machine. That is true before anyone installs a monitoring product.
So the useful question is not whether you could be monitored. It is which specific things are being collected, and whether anybody is looking. Those have different answers and only the first is visible from the device.
Checking a Windows machine
Four checks, in order of how much they tell you.
Device management enrollment. Settings, then Accounts, then Access work or school. If a work account is listed, the machine is managed. Click it and choose Info to see what policies apply and when it last synced.
Installed software. Settings, then Apps, then Installed apps. Sort by install date. Monitoring products usually appear here under their real names, because most are not trying to hide.
Running processes. Ctrl, Shift and Escape opens Task Manager. Look at the Details tab rather than Processes, because it shows every process rather than only the ones with visible windows. For anything unfamiliar, right click and choose Open file location, then search the file name.
Startup entries. The Startup apps tab shows what launches with the machine. Monitoring agents have to start automatically to be useful, so they are nearly always here.
Checking a Mac
The equivalent checks, with one that gives a clearer answer than anything on Windows.
Device management profiles. System Settings, then Privacy and Security, then Profiles or Device Management. If a configuration profile is installed, the machine is managed and the profile lists what it controls. If there is no Profiles entry at all, the Mac is not enrolled.
Login items. System Settings, then General, then Login Items. This shows both what starts at login and which background items are permitted to run.
Activity Monitor. In Applications, then Utilities. Sort by process name and look for unfamiliar entries, particularly ones owned by root rather than by your user.
Screen and input permissions. Privacy and Security, then Screen and System Audio Recording, and separately Accessibility and Input Monitoring. Anything that captures your screen or keystrokes on a modern Mac has to appear in these lists. This is the single most informative check available on either platform.
What each finding actually means
| What you find | What it means | How concerned to be |
|---|---|---|
| Device management enrollment | Standard on corporate hardware. Enables software inventory, policy, and location | Expected, not evidence of monitoring |
| Antivirus or endpoint security | Security tooling. Reads a great deal but for threats, not productivity | Expected |
| A named time tracking or activity app | Activity monitoring, usually disclosed | Ask what it collects and how long it is kept |
| Screen recording permission granted | Something can capture your display | Worth a direct question |
| Input monitoring permission granted | Something can read keystrokes | Worth a direct question, in writing |
| A process you cannot identify at all | Unknown. Could be an internal tool | Ask IT rather than guess |
The distinction that matters is between security tooling and productivity monitoring. Both read a lot. They exist for different reasons, are usually run by different teams, and produce reports that go to different people. Our explainer on computer monitoring covers what each category actually captures.
What you are entitled to know
In four states, a written answer is not a favor. Connecticut, Delaware, Maine, and New York each require employers to give notice of electronic monitoring, and in Delaware and New York the employee has to acknowledge it. If you are working in one of those states and never received one, that is a compliance gap rather than a mystery. The specifics are in our guide to employee monitoring laws by state.
Everywhere else, asking still works better than searching. A written question to IT or HR about what is collected, who can see it, and how long it is kept produces a documented answer, and the answer is usually less alarming than the uncertainty.
You are not unusual for minding. Pew Research Center found in 2023 that 81% of US adults think workers would feel inappropriately watched if employers collected and analyzed information about how they do their jobs, and that 51% oppose recording what people do on their work computers outright.
If you are the employer reading this
People search for this because they suspect something and were not told. That is a policy failure, and it is cheap to fix.
Publish what is collected, in plain language, before anyone has to go looking in Task Manager. Let people see their own record. Never deploy an agent configured to hide, because the day it is discovered is the day every other statement you have made about trust is re-examined. Our guide to writing a monitoring policy has the structure, and a page nobody had to hunt for is worth more than any feature you could buy.
Key takeaways
- Most monitoring is not hidden. It appears in installed software, startup items, and running processes under its real name.
- On macOS, Screen Recording and Input Monitoring permissions are the clearest evidence available on either platform. Anything capturing your screen or keystrokes must appear there.
- On Windows, check Access work or school for enrollment, then installed apps, Task Manager Details, and startup entries.
- Device management enrollment is standard on corporate hardware and is not by itself evidence of productivity monitoring.
- Security tooling and productivity monitoring both read a lot, but they exist for different reasons and report to different people.
- In Connecticut, Delaware, Maine, and New York you are entitled to written notice of electronic monitoring.
- Asking in writing beats searching. It produces a documented answer, and it is usually less alarming than the uncertainty.
Frequently asked questions
How can I tell if my employer is monitoring my computer?
Check four places. On Windows: Access work or school in Settings for device management enrollment, installed apps sorted by date, the Details tab of Task Manager, and startup entries. On macOS: Profiles under Privacy and Security, Login Items, Activity Monitor, and the Screen Recording and Input Monitoring permission lists. Most monitoring software appears under its real name.
Can monitoring software be completely hidden?
Some products advertise a stealth mode that hides from the taskbar and the process list, so a clean check is not proof of absence. On macOS this is harder than it used to be, because anything capturing the screen or reading keystrokes must appear in the relevant permission list. A hidden agent also cannot satisfy the notice duty in states that have one.
Is my employer allowed to monitor my work computer?
Monitoring employer owned equipment is broadly permitted in the United States. Connecticut, Delaware, Maine, and New York require written notice, and in Delaware and New York the employee must acknowledge it. Elsewhere the constraints come from federal wiretap law, state recording consent rules, and limits on off duty monitoring.
What does device management enrollment mean?
It means the machine is registered with a platform such as Microsoft Intune or Jamf, which lets an administrator apply policy, inventory and install software, encrypt the disk, locate the device, and wipe it remotely. This is standard on corporate hardware and is not by itself evidence that anyone is watching your activity.
Should I remove monitoring software I find?
No. On a device your employer owns, removing management software or a monitoring agent is normally a policy violation, and it is visible to IT the moment the machine stops reporting. It also converts a question you can ask openly into a disciplinary matter. Ask what is collected instead.
Does my employer monitor my personal laptop?
Not unless you installed something that lets them, such as a device management profile, a company VPN client, or a monitoring agent required for remote access. Without ownership of the hardware the employer's legal position is much weaker, and off duty and personal device restrictions apply with more force.
Can my employer read my personal messages on a work computer?
Technically, monitoring that captures screens or keystrokes will capture whatever is on screen, including personal mail and messages. Some tools blur or exclude named applications, and many do not. The practical protection is to keep personal accounts off employer hardware entirely.
How many people object to being monitored?
Pew Research Center found in 2023 that 81% of US adults believe workers would feel inappropriately watched if employers collected and analyzed information about how they do their jobs, and that 51% oppose employers recording what people do on their work computers.