In short
Screen monitoring software for employees captures what appears on work computer screens, either live or as recordings that can be played back and searched. Teramind offers live view, session recording, snapshots, optional audio, OCR text search and capture of remote desktop and Citrix sessions, with settings to record only around rule breaches or exclude private activity.
Get a quote for Screen monitoring software
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What employee screen monitoring software does
Employee screen monitoring software records the desktop of a work computer as video or as periodic screenshots. Authorised reviewers can watch a session live or play back an earlier one, usually with the user's activity shown on a timeline so they can jump to the moment that matters.
Organisations use it for three main reasons:
- Investigation and evidence: an alert about a file upload or a suspicious email means more when you can see what the user was doing at the time.
- Regulated or high-risk work: oversight of privileged administrators, third-party contractors on remote desktops or staff handling payments.
- Support and training: seeing exactly what someone saw when a process went wrong.
Screen capture is also one of the most intrusive forms of monitoring, because a screen can show anything: a private message, a medical appointment, a family photo. The ICO lists screenshots and webcams among the methods its guidance covers, and screen recording is a strong candidate for a data protection impact assessment. The settings below exist to keep it in proportion.
Teramind live view and session recording
Teramind includes screen recording and live view on every plan. The Session Player is where reviewers watch screens:
- Live view: a real-time view of an online user's desktop. The Live View dashboard also shows a montage of online screens, a list of live users with their current activity and a snapshot view of each screen at intervals.
- History view: playback of earlier sessions, with activities and rule alerts pinned on the timeline as colour-coded markers.
- Multiple screens and sessions: playback covers multi-monitor set-ups and switching between the computers a user worked on that day.
- Evidence export: still images and video clips can be exported for an HR process, audit or incident report.
- Remote control and input freeze: an administrator can take control of a live session for support, or freeze the keyboard and mouse to stop a high-risk action. Both must be allowed in the monitoring settings first, and you can show the user a message when they are used. Neither is available on the Linux agent.
- Audio: optional and switched off by default; audio capture is tied to screen recording and is supported on Windows.
Alerts link straight into the recording, so a reviewer looking at a behaviour rule alert or an insider threat case sees the minutes around the event rather than a log line. From the UAM plan, rules can also use a Record Video action to save video around a violation.
OCR: searching what was on screen
Optical character recognition (OCR) extracts the text that appeared on screen in recordings, so reviewers can search sessions for a phrase, an account number or a project code, by plain text or regular expression, without watching hours of video. Because it reads the screen itself, it also finds text in applications and documents that cannot be parsed any other way. Each result links to a snapshot of the screen and to the recording. OCR text can also drive behaviour rules on Windows and macOS.
OCR is included in Teramind Enterprise; Teramind's plan guide lists it as a paid add-on on the Starter, UAM and DLP plans, which we confirm at quote. You choose which supported languages are processed and from which date recordings are processed.
OCR makes recordings far more searchable, which is also why it needs thought: text from every screen becomes findable. We recommend tying OCR to specific investigation and data protection purposes in your DPIA rather than switching it on everywhere by default. If your main aim is stopping sensitive data leaving, content rules in Teramind DLP may be the more targeted tool.
Remote sessions, macOS and Linux
Many organisations need to watch remote desktop sessions rather than laptops: contractors working through a jump server, staff on virtual desktops, or privileged access to servers.
| Environment | Screen capture in Teramind |
|---|---|
| Windows desktops and laptops | Full support: recording, live view, record only on rule violation, remote control and audio |
| Remote Desktop (RDP) and terminal servers | With the agent on the terminal server, each RDP user's session is recorded separately; an agent on the local computer sees the RDP window only as an application |
| Citrix and VMware Horizon | Supported session types for the agent |
| macOS | Screen recording, plus Reconstructed Video in NextGen: the desktop rebuilt from window details and on-screen text without capturing screen pixels, needing only the Mac's Accessibility permission |
| Linux | Screen recording with some settings unavailable (including record only on rule violation and remote control); interactive SSH terminal sessions are recorded as video |
Check the details for your estate on the Teramind agent page, and see Teramind deployment options for where recordings are stored.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Privacy settings that limit screen capture
Teramind's monitoring profiles give you real choices about how much is captured. The ones we use most:
- Live view only: watch a screen live when there is a reason to, with nothing recorded and no video kept.
- Record only when a behaviour rule is violated: video is saved for a set number of minutes before and after a breach, and not otherwise. This needs the Record Video rule action, which starts on the UAM plan.
- Application and website scoping: record only listed applications or sites, or exclude others such as personal banking and health sites. Excluded windows are blacked out in live view and playback.
- Content-based exclusion: suspend recording when a web page contains text you specify.
- Private browsing: suspend monitoring of private (incognito) windows, which are blacked out.
- Schedules and locked sessions: record only in working hours, and choose whether to record while a computer is locked.
- Retention: on-premises and private cloud customers set their own retention, and on-premises servers can delete recordings automatically after a set number of days. Teramind Cloud has a published standard retention period, with longer retention available as an option; we confirm the details at quote.
- Role-based access: decide who can watch recordings at all; viewing and exporting are logged in the Audit dashboard.
The ICO says retention should be no longer than necessary and backed by a retention schedule, so agree the period before you start recording, not after the storage fills up.
Matching the setting to the purpose
| Purpose | Lighter option to consider first |
|---|---|
| Evidence when a security rule fires | Record only around rule violations, rather than continuous video |
| Supporting staff with a problem | Live view with remote control, announced to the user, and no recording |
| Oversight of privileged or contractor access | Full recording limited to the servers, remote sessions or applications concerned |
| Checking working hours | Log-on, activity and schedule reports, with screen capture switched off |
| Finding where sensitive data was viewed | OCR on a defined set of users or applications, for a defined period |
Webcams, screenshots and the law
The ICO's guidance names webcams and screenshots among the monitoring methods it covers, and uses a webcam case as a warning. In its example, an employer finds a few remote workers started later than their timesheets said and rolls out device monitoring that gives managers automatic webcam images. The ICO says that is likely to infringe data protection law because it is disproportionate: the employer could check the times workers log on and give them the chance to explain any discrepancies.
Teramind's camera usage channel, available from the UAM plan on Windows, reports when a webcam is in use and which application is using it. It does not capture video or audio from the webcam, so it can serve a security purpose without images of the person. Screen recording itself still needs the same care: a lawful basis, workers told about it in your monitoring policy, and a DPIA that records why lighter options such as activity logs or rule-triggered recording are not enough. For home workers the risk of capturing family life is higher; see monitoring employees working from home. This is general information, not legal advice.
We help you choose and configure the settings above to match your DPIA, roll out the agent and train the people who will review recordings. Ask us for a quote.
How Forever Systems helps with employee monitoring
We supply, set up and support Teramind for UK organisations. Monitoring only works if it is lawful and trusted, so we help you collect what you can justify rather than everything the product can record.
- Scoping: we talk through what you want to achieve, who and which devices are in scope, and which Teramind plan and hosting option fit
- Inputs for your paperwork: we explain what each setting records, so your data protection impact assessment and monitoring policy describe the real set-up
- Privacy-first configuration: recording schedules, exclusions, masking, role-based access and a visible agent where that is right for you
- Deployment: agent roll-out through your existing device management tools, plus the rules, alerts and dashboards that answer your questions
- Ongoing help: we can help your administrators tune rules, keep agents up to date and review plans and licence counts at renewal
We are an IT and cyber security provider, not a law firm: for legal questions about monitoring your staff, take advice from an employment or data protection lawyer. Ask us for a quote and we will reply with options.
Frequently asked questions
Can employers watch your screen at work in the UK?
They can, if the monitoring is lawful: there must be a clear purpose and lawful basis, workers must be told, and the intrusion must be proportionate. Screen recording is intrusive, so the ICO expects careful justification and usually a DPIA. Covert screen monitoring is only for exceptional cases. This is general information, not legal advice.
Does Teramind take screenshots or record video?
Teramind records the screen as video that can be watched live or played back, and its Live View dashboard also shows snapshots of each screen at intervals. Recordings can be limited to working hours, specific applications or the minutes around a rule violation.
Can Teramind record only when something goes wrong?
Yes. With the record-only-on-violation setting and the Record Video rule action (from the UAM plan), Teramind saves video only for a set period before and after a behaviour rule is breached. Live view stays available, but no other video is kept. This option is not available on the Linux agent.
Is OCR included in Teramind?
OCR is included in Teramind Enterprise and is a paid add-on on the Starter, UAM and DLP plans. It makes on-screen text in recordings searchable and can drive behaviour rules on Windows and macOS. Ask us for a quote that includes it if you need it.
Does Teramind record webcams?
No. Teramind's camera usage channel reports when a webcam is in use and which application is using it, without capturing video or audio from the camera. The ICO gives automatic webcam images of remote workers as an example of disproportionate monitoring, so we do not recommend webcam capture as part of an employee monitoring set-up.
Still have a question about Screen monitoring software?
Ask us and a member of our team will reply by email.