2

For example if I'm having a conversation in Skype, can he secretly log in in parallel with me and watch my screen? If yes, how to block him? I believe I have admin rights on my dev PC.

4
  • 1
    I have to admit, this question has an interesting perspective! Admin as the bad guy. I like it ;-) Jun 3, 2009 at 9:16
  • 1
    Interesting perspective? C'mon, admin is a classical evil personage trying to take over the whole operation. An ordinary user is a white hero defending himself against the darkness.
    – Mastermind
    Jun 3, 2009 at 12:40
  • "Mastermind", this is the second post of this type to come from you. It's beginning to look a lot like you're trolling. Jun 3, 2009 at 13:52
  • Isn't it foolish to use your employer's equipment for anything you don't want your employer to know about? Nov 2, 2010 at 14:38

14 Answers 14

10

Short answers: "Yes", and "you can't".

Bring your own laptop to work if you want privacy.

5
  • 1
    Which still wouldn't bring privacy if you're plugged into their network. Jun 3, 2009 at 9:14
  • 2
    It would most likely violate a policy anyway to plug an unknown laptop into the network - unless there's a guest network available to use - +1 for the answer btw ^^ Jun 3, 2009 at 9:18
  • Ok, bring your own laptop and use encryption or your own 3G-modem. Learn about ssh -D.
    – Thomas
    Jun 3, 2009 at 19:27
  • 1
    Circumventing the access controls in many organization is a clear violation of security policy and can be grounds for termination without notice. This means if you bring your own laptop to work and use it to access content you wouldn't be able to (ie through a 3G modem) you can be fired. Immediately.
    – jtimberman
    Jul 7, 2009 at 2:02
  • 2
    If you bring your own laptop in, and plug it into my network, I'll come along with a big stick. Nov 2, 2010 at 13:19
4

Generally no. RDC will lock your screen if they try to login however there are numerous other ways to see it such as installed transparent screen grabbers or using proxies to intercept traffic. You should trust your IT admin. If you don't, there is a problem.

1
  • It's not so much a matter of trust of the sysadmin. The sysadmin might be required to do the spying by management, HR, etc. Jun 3, 2009 at 12:37
4

There is always the possibility that your admin has installed the equivalent of malware to watch you, but that's pretty draconian for most places unless someone has given them a reason.

Generally speaking, when it comes to work PCs, the employer has a right to do whatever they want, because it's their hardware, their software, and their time. Your admin should be acting as the enforcement arm of management, so if he's monitoring your computer, your issue isn't with him, it's with the corporate decisionmakers who decided that it was necessary.

Also, if your admin is monitoring you and you disable it, I can promise that he or she will be displeased and it won't earn you any brownie points. It'll probably just make your life more difficult.

1
  • Employer's right's also depend on jurisdiction, what is in the employment contract and on employers PC/Network usage policies which the employee has been properly informed of. I believe there have been cases where employers have been penalised for reading private email sent by employees using the employer's equipment in company time. Nov 2, 2010 at 14:34
2

Even if he can't see your session directly, he can still watch the traffic coming out of your PC, or the address/port it's destined for, and get an idea of what you're doing that way. If this is presenting you with a problem, maybe you shouldn't be doing it.

1

Yes, "We" can see what you're doing, long story short.

Here, we use Altiris to enable Helpdesk to administer your machine from afar, as well as perform application metering, maintaining configuration standards in the guise of rapid image deployment.

On our network and in our company, Skype is a banned application.

If you install it, thanks to app metering, we'll know within 24/48 hours.

Altiris also comes with a remote control function that can be hidden from the logged-on user. (At least the taskbar display icon, etc.) If the bosses-that-be decide you need to be monitored, after our system emails us that you've installed Skype, then we'll do so.

Remember that "Use of electronic company equipment constitutes consent to monitoring", etc, blah, blah? Maybe it was worded differently in your company. Either way, I'll bet you a can of soda pop that your sr. IT, HR and Legal management have agreed on this policy.

Let's say that you install Skype anyway and we don't catch it for a while. I'm still a pretty good network admin though, I'll probably catch the traffic from it on one of my wireshark or LanHound monitoring laptops.

Or, you could just whip out your cell phone and call whomever it is you want to talk to, completely independent of your work-network. At that point, all you need to worry about is the NSA. :)

And you're not doing anything wrong, right?

1
  • Hello. Has this changed at all? Its now 2018, does it still require a third party tool?
    – M H
    Jan 30, 2018 at 19:23
0

Yes, it is very much possible to login to a system and see what a user is doing. There are softwares like RAdmin and VNC which gives you real time console. Generally these softwares are use for remote administration but can be used for spying as well.

There are also few spy tools available but they contain all sort of malware so I guess your administrator wont install them.

0

Have you given your admin a reason to want to watch you? To be fair, asking the question "Can you see what I'm doing?" is as good as painting a target on your back!

0

Yes you can, thanks to virtualization.

Bring your own external HDD with your OS of choice. Fire up KVM/Xen/VirtualBox/VMWare/VirtualPC, have it run the OS on the main HDD (this might take some work unfortunately but it's definitely possible). Your admin can see what's going on in the virtualized system, but he can't see what you're doing above.

Caveat: if he's reaaaally good, and he has nothing better to do, he could have planted a rogue hypervisor in the Bios. But he's not THAT good.

3
  • Although, even if whatever restrictions are in place let him install VMWare and connect a USB device, as soon as any traffic leaves the PC it will be visible on the network.
    – RainyRat
    Jun 3, 2009 at 10:45
  • You don't have to install anything, just run a Live CD, Live USB or a full fledged system installed on an USB disk. As for network traffic, well, that's what SSL is for.
    – niXar
    Jun 3, 2009 at 11:29
  • 1
    SSL won't hide much. Maybe the data on the sites you visit but the full list will be visible through DNS requests.
    – Ryaner
    Jun 3, 2009 at 13:33
0

Your a end user of the network, it's up to the network administrator to control usage, misuse and access as he sees fit. THe way your asking seems like your doing private non work related matters at work and don't want to be caught. Anyways if you feel like he is acting inapproiately you should be contacting your departmental manager and asking them to contact the IT department.

0

If he has time/interest to monitor you, he can see everything you do. And while a tit-for-tat session between two admin-level users can be intellectually invigorating, all you're going to accomplish is to make him more interested in you. IMHO, not attracting attention in the first place is the best option.

Now.. the question is: Why you want to block him? Depending on your local privacy laws, you either are not supposed to use a company computer for non-corporate Skype chats, or what he's doing is highly illegal. If it's the former, I can't help you. If it's the latter. then I suggest logging all software installations and/or remote control sessions to gather proof for any future corporate or legal action.

0

There's a reason why your admin is the admin, and that's because it's part of his job to ensure that the activities of one or two (or more) people don't compromise the availability of services for all. You're on a corporate network, and that means that you're using shared services. The example of Skype may not use much bandwidth, but that's less bandwidth available for legitimate business use. The same applies to storing MP3s on network shares and anything else like that.

0

So to throw in my 2 cents here :)

I echo what everyone said about using work pc's for work only. If you're worried about him knowing what you are doing, then you shouldn't be doing it.

So that said, there is one loop hole you MIGHT be able to get away with is turn on the windows firewall and block everything by default (disable all exceptions and prompt before allowing) then as stuff requests network access, you can see it and allow or deny it. The advantage to this is its included with windows so you are not installing anything extra on your computer and if you are a laptop user you can claim it was to protect the laptop while you are on your home network since you don't trust your son's friend's laptop that he comes over with and plays WOW all night on.

That said the admin might have a GPO in place that disables your access to the windows firewall. Best you can do there is use wireshark and see if anything "interesting" is going out.

And for the recommendations about bringing in another external drive, or laptop, one place I worked did not allow any of that, first time you did it you got a warning put in your file, second time you got fired.

0

The answer is YES, YES, YES. We use IntelliAdmin. It allows us to login remotely and totally undetected while the user is logged in and using their machine. We can see whats on your screen, minupulate your mouse and keyboard, and even lockout your mouse and keyboard.

This tool was originally purchased for assisting end-users with issues.

Our version only works inside the network and requires no third party software on the remote machine, but there is an 'internet' version that will work from anywhere.

http://www.intelliadmin.com

1
  • Try out their free trial at IntellAdmin.com
    – cop1152
    Jun 3, 2009 at 12:05
-1

It is not possible to snoop on your machine without extra software. Remote Desktop does not allow a 'view' or share - Remote Assistance does but requires you to initiate it.

VNC/RAdmin etc require that you install software on your machine, and although it can be push installed from a remote location, it's not generally done, and will alert you that it is installed or that someone is using the connection. The same applies to LogMeIn and GoTomyPC

Back Orifice will do exactly what you are afraid of, but is detected by even the lowliest of Antivirus products.

Dameware allows surreptitious observations of a machine (most others tell you that you are being observed) and also allows the remote administrator to push the installation onto your machine as standard.

The real question you should be asking is this ...

If you are scared of being discovered - should you really be doing it in the first place? Is it breaking acceptable usage policies? Are your actions illegal / against your employers company interest?

If so - do not be scared of doing things you could be disciplined for by SIMPLY NOT DOING IT!

Of course it is also possible to identify the port your PC is connected on, set that as a monitor port and send all its traffic to a packet capture station (thats what most big corporates do in cases where monitored activity is required) There - they see everything.

I have before now installed SSH on windows machines, so that I can run command line utilities such as PSLIST and PSKILL to see if people are doing things they shouldnt and stop them)

So the short answer to your question is 'No, not easily' The long answer to your question is 'Yes they can monitor everything you do, the level of their monitoring will take different amounts of effort, and often the effort is too much for the end results'

Not the answer you're looking for? Browse other questions tagged .