For example if I'm having a conversation in Skype, can he secretly log in in parallel with me and watch my screen? If yes, how to block him? I believe I have admin rights on my dev PC.
There is always the possibility that your admin has installed the equivalent of malware to watch you, but that's pretty draconian for most places unless someone has given them a reason.
Generally speaking, when it comes to work PCs, the employer has a right to do whatever they want, because it's their hardware, their software, and their time. Your admin should be acting as the enforcement arm of management, so if he's monitoring your computer, your issue isn't with him, it's with the corporate decisionmakers who decided that it was necessary.
Also, if your admin is monitoring you and you disable it, I can promise that he or she will be displeased and it won't earn you any brownie points. It'll probably just make your life more difficult.
Yes, "We" can see what you're doing, long story short.
Here, we use Altiris to enable Helpdesk to administer your machine from afar, as well as perform application metering, maintaining configuration standards in the guise of rapid image deployment.
On our network and in our company, Skype is a banned application.
If you install it, thanks to app metering, we'll know within 24/48 hours.
Altiris also comes with a remote control function that can be hidden from the logged-on user. (At least the taskbar display icon, etc.) If the bosses-that-be decide you need to be monitored, after our system emails us that you've installed Skype, then we'll do so.
Remember that "Use of electronic company equipment constitutes consent to monitoring", etc, blah, blah? Maybe it was worded differently in your company. Either way, I'll bet you a can of soda pop that your sr. IT, HR and Legal management have agreed on this policy.
Let's say that you install Skype anyway and we don't catch it for a while. I'm still a pretty good network admin though, I'll probably catch the traffic from it on one of my wireshark or LanHound monitoring laptops.
Or, you could just whip out your cell phone and call whomever it is you want to talk to, completely independent of your work-network. At that point, all you need to worry about is the NSA. :)
And you're not doing anything wrong, right?
Yes, it is very much possible to login to a system and see what a user is doing. There are softwares like RAdmin and VNC which gives you real time console. Generally these softwares are use for remote administration but can be used for spying as well.
There are also few spy tools available but they contain all sort of malware so I guess your administrator wont install them.
Yes you can, thanks to virtualization.
Bring your own external HDD with your OS of choice. Fire up KVM/Xen/VirtualBox/VMWare/VirtualPC, have it run the OS on the main HDD (this might take some work unfortunately but it's definitely possible). Your admin can see what's going on in the virtualized system, but he can't see what you're doing above.
Caveat: if he's reaaaally good, and he has nothing better to do, he could have planted a rogue hypervisor in the Bios. But he's not THAT good.
Your a end user of the network, it's up to the network administrator to control usage, misuse and access as he sees fit. THe way your asking seems like your doing private non work related matters at work and don't want to be caught. Anyways if you feel like he is acting inapproiately you should be contacting your departmental manager and asking them to contact the IT department.
If he has time/interest to monitor you, he can see everything you do. And while a tit-for-tat session between two admin-level users can be intellectually invigorating, all you're going to accomplish is to make him more interested in you. IMHO, not attracting attention in the first place is the best option.
Now.. the question is: Why you want to block him? Depending on your local privacy laws, you either are not supposed to use a company computer for non-corporate Skype chats, or what he's doing is highly illegal. If it's the former, I can't help you. If it's the latter. then I suggest logging all software installations and/or remote control sessions to gather proof for any future corporate or legal action.
There's a reason why your admin is the admin, and that's because it's part of his job to ensure that the activities of one or two (or more) people don't compromise the availability of services for all. You're on a corporate network, and that means that you're using shared services. The example of Skype may not use much bandwidth, but that's less bandwidth available for legitimate business use. The same applies to storing MP3s on network shares and anything else like that.
So to throw in my 2 cents here :)
I echo what everyone said about using work pc's for work only. If you're worried about him knowing what you are doing, then you shouldn't be doing it.
So that said, there is one loop hole you MIGHT be able to get away with is turn on the windows firewall and block everything by default (disable all exceptions and prompt before allowing) then as stuff requests network access, you can see it and allow or deny it. The advantage to this is its included with windows so you are not installing anything extra on your computer and if you are a laptop user you can claim it was to protect the laptop while you are on your home network since you don't trust your son's friend's laptop that he comes over with and plays WOW all night on.
That said the admin might have a GPO in place that disables your access to the windows firewall. Best you can do there is use wireshark and see if anything "interesting" is going out.
And for the recommendations about bringing in another external drive, or laptop, one place I worked did not allow any of that, first time you did it you got a warning put in your file, second time you got fired.
The answer is YES, YES, YES. We use IntelliAdmin. It allows us to login remotely and totally undetected while the user is logged in and using their machine. We can see whats on your screen, minupulate your mouse and keyboard, and even lockout your mouse and keyboard.
This tool was originally purchased for assisting end-users with issues.
Our version only works inside the network and requires no third party software on the remote machine, but there is an 'internet' version that will work from anywhere.
It is not possible to snoop on your machine without extra software. Remote Desktop does not allow a 'view' or share - Remote Assistance does but requires you to initiate it.
VNC/RAdmin etc require that you install software on your machine, and although it can be push installed from a remote location, it's not generally done, and will alert you that it is installed or that someone is using the connection. The same applies to LogMeIn and GoTomyPC
Back Orifice will do exactly what you are afraid of, but is detected by even the lowliest of Antivirus products.
Dameware allows surreptitious observations of a machine (most others tell you that you are being observed) and also allows the remote administrator to push the installation onto your machine as standard.
The real question you should be asking is this ...
If you are scared of being discovered - should you really be doing it in the first place? Is it breaking acceptable usage policies? Are your actions illegal / against your employers company interest?
If so - do not be scared of doing things you could be disciplined for by SIMPLY NOT DOING IT!
Of course it is also possible to identify the port your PC is connected on, set that as a monitor port and send all its traffic to a packet capture station (thats what most big corporates do in cases where monitored activity is required) There - they see everything.
I have before now installed SSH on windows machines, so that I can run command line utilities such as PSLIST and PSKILL to see if people are doing things they shouldnt and stop them)
So the short answer to your question is 'No, not easily' The long answer to your question is 'Yes they can monitor everything you do, the level of their monitoring will take different amounts of effort, and often the effort is too much for the end results'