Screenshots provide a clear image of user activity on computers running the ActivTrak Agent. With visual records, it's easy to see what happened and when, the intent behind user actions, and to gain insights into how teams work. Screenshots should be used sparingly and only as needed.
Contents
- Screenshot requirements
- Creating screenshot alarms
- Redacting screenshots
- Searching for specific screenshots
- Deleting screenshots
- Disabling screenshots
- Screenshot best practices
- Screenshot troubleshooting
- Frequently asked questions
- Learn more
Screenshot requirements
All screenshots are triggered by Alarms. The ability to configure screenshot alarms has different requirements based on your plan type:
| Plan | Requirement |
|---|---|
| Free | not available |
|
Essentials Essentials Plus Professional |
Screen Details Add-on |
|
Advanced Premium |
Sensitive Data Visibility set to "Full Details" |
Note: Once the above requirements are met, screenshots are still off by default until a screenshot alarm is created and enabled.
Creating screenshot alarms
Alarms require a type, condition(s), and action(s). Use this detailed guide to better understand alarms and how to create your own.
Screen captures are one of the six main actions that can be set for alarms if the conditions are met:
You can choose to capture a single screenshot or multiple screenshots. The 'Multiple Screenshots' option will require you to enter a frequency of at least 10 seconds:
In the example above, the agent will continue to take screenshots every 10 seconds until one of the three occurs:
- The user switches the active window,
- The user enters a passive state, or
- The limit of 100 screenshots per activity is reached.
This means that for long activities without a window change, and/or a high frequency of captures, screenshots may reach the limit before the end of the activity, appearing to end "early".
The screenshot alarm is only available out of the box to customers with accounts created before May 29, 2024, who meet the requirements listed above. The out-of-the-box alarm triggers one screenshot when any user has been active on a new activity for at least 20 seconds. This often generates a very high volume of screenshots, and we typically suggest adding more conditions if you choose to use it.
If your account does not have this alarm and you want to create it, the configuration is listed below. For a detailed step-by-step guide on how to create a custom alarm, refer to this guide.
- Alarm Type: Activity
- Selected Groups: All Users and Computers (or, choose a specific group(s) to tighten the scope)
- Conditions: Match Any, Duration (seconds) Greater Than 20 (or, choose Match All and add fields such as a specific user or a specific URL to tighten the scope)
- Actions: Toggle 'Capture screenshots when the alarm is triggered' and choose single or multiple. Add other actions as desired, but keep in mind that if your scope is too large, something like an email notification may flood your inbox.
Redacting screenshots
Screenshot redaction uses an algorithm to cover certain sensitive information with a dark line, restricting its visibility. Redaction is currently available only to legacy accounts that previously had it enabled. We no longer offer screenshot redaction as an add-on. If your account already has Screenshot Redaction, learn more here.
Searching for specific screenshots
Depending on the scope of your screenshot alarms, looking through all captured screenshots can become overwhelming. Save time and effort by filtering screenshots. Navigate to Notifications > Compliance Alarms > Screenshot History and narrow down your search using the date or group filters in the top left. You can also expand the 'Filter Screenshots' section by clicking the plus sign on the right, which opens additional options. The example below shows a narrow search of screenshots only from the SDR team in which the URL contains "claude" within the Last 7 Days:
Deleting screenshots
Important: We cannot recover screenshots once they are deleted
To delete screenshots, navigate to Notifications > Compliance Alarms > Screenshot History and select the individual screenshots you would like to delete, or select one page at a time by clicking 'Select All'.
Next, click on the 'Delete Selected Screenshots' button in the upper right. You will be prompted to confirm the screenshots you would like to delete by checking "I confirm I want to delete (#) selected screenshots." Then click the 'Delete Selected Screenshots' button within the pop-up:
Note: Deleting all screenshots at once is not available. However, up to 510 screenshots can be shown per page, allowing the bulk deletion of 510 screenshots at a time. If you have a large number of screenshots to delete and this action is unreasonable, please contact Support.
Disabling screenshots
Screenshots are disabled by default. If screenshots were enabled for your account and you have changed your mind, you can disable screenshots by navigating to Notifications > Compliance Alarms > Alarm Configuration.
Alarms with the screen capture action enabled will display an icon in the "Screen Captures" column. In the example below, the column has been filtered to show all alarms configured to take a single screenshot.
To turn off an alarm completely, adjust its toggle in the leftmost "Status" column; blue / to the right is enabled, and gray / to the left is disabled. In the example above, the "Firefox" alarm has screenshots as its only action, so it can be toggled off.
To keep an alarm enabled but remove the screenshot action, click the Edit button. In the example above, the "CNN" alarm has other actions, such as an email notification and pop-up, that you may still wish to trigger. Instead of toggling it off completely, you can toggle off only the screen captures while keeping the other actions and save the alarm.
It will take a few minutes for the agent to update with any configuration changes.
Screenshot best practices
Screenshots provide valuable visual evidence of user activity; however, they should be used strategically to minimize unnecessary storage usage and maintain optimal system performance. Follow these best practices for optimal screenshot configuration:
Better Leverage the Alarm and Activity Logs
The Alarm Log and Activity Log already provide comprehensive traceability for incidents, including timestamps and the duration of each activity. These logs can often reduce your need for excessive screenshots.
Actions
- Review your Alarm Log configuration to ensure it captures essential details
- Configure your Activity Log to track relevant information
- Use screenshots only when visual confirmation is necessary
Avoid Using Screenshots for Alarms Without Conditions
Enabling screenshots for broad, condition-free alarms (such as "any activity over 20 seconds") can generate an overwhelming number of unnecessary screenshots.
Actions
- Add specific conditions to screenshot-enabled alarms
- Target screenshots to activities that genuinely require visual documentation
- Review and disable any overly broad screenshot alarms
Minimize Use of the Multi-Screenshot Feature
Taking multiple screenshots per incident can quickly consume storage and create unnecessary visual data. In most cases, a single screenshot combined with log data provides sufficient context.
Actions
- Configure alarms to capture single screenshots when possible
- Use the Alarm and Activity Logs to complement single-screenshot evidence
- Reserve multi-screenshot configuration for critical investigations only
Narrow Down Conditions When Using Multi-Screenshots
When multiple screenshots are necessary, use highly specific conditions to prevent triggering screenshots for common activities.
Actions
- Avoid general conditions like "accessing google.com" that would generate frequent screenshots
- Set longer intervals between screenshots (60 seconds or more is recommended)
- Create narrowly defined conditions that target only the specific activities requiring documentation
Implement Screenshot Rotation
For accounts with limited storage or screenshot allowances, implement a rotation schedule to maintain only the most relevant screenshots.
Actions
- Regularly review and delete outdated screenshots
- Establish a retention policy based on your compliance requirements
- Schedule periodic cleanup of screenshot history
By implementing these best practices, you can ensure your screenshot functionality captures what you need without exceeding storage limits or creating unnecessary performance impacts. Remember that screenshots are turned off by default and should only be enabled when they serve a specific purpose in your monitoring strategy.
Screenshot troubleshooting
If you are unable to view Screenshots, there are a variety of reasons why:
Screen Details Add-on not purchased (Essentials, Essentials Plus and Professional Plans)
Essentials, Essentials Plus, and Professional Plans require the Screen Details Add-on to take screenshots. Contact ActivTrak Sales to purchase.
Sensitive Data Visibility setting (Advanced and Premium Plans, and Professional Trials)
Advanced and Premium Plans, as well as Professional Trials, require Sensitive Data Visibility to be set to "Full Details" to take screenshots. Admins can confirm or adjust this setting by navigating to Settings > Account Configuration. When set to anything other than "Full Details", the ability to take screenshots is not available for the account. Learn more about Data Privacy Controls here.
Screenshot alarm(s) not enabled
By default, screenshots are turned off, even if you have purchased Screen Details or set Sensitive Data Visibility to "Full Details". To get started, navigate to Notifications > Compliance Alarms > Alarm Configuration and enable one of the out-of-the-box alarms available in your account. You can also create new alarms. Alarms are enabled when the button on the far left is blue. You will see a screenshot icon next to any alarm that is configured to take screenshots.
The duration condition is too high
Each time the active window switches to a different website or application, the timer restarts and alarm conditions are rechecked. If the duration condition is not met, the conditions may not be met before the active window changes, and a screenshot will not be triggered. We usually do not advise setting the initial screenshot duration higher than 1 minute, which is a Value of 60.
Filters
Under Notifications > Compliance Alarms > Screenshot History, you can filter screenshots at the top. Sometimes, however, there may be no data to match the applied filters. Make sure your filters are set to the date range when the screenshots were taken (for example, a working day, not a weekend), and that the selected user, computer, or group has a screenshot alarm enabled.
Account has exceeded the license limit
Paid accounts have an agreed number of licenses. If this amount is exceeded past the grace period, data will still be collected, but screenshots and reports will not be viewable until users are removed or more licenses are purchased. You may notice a banner at the top of your account:
Note that deleting a user or computer will only delete the historical data collected unless you have also uninstalled ActivTrak from the user's computer. If the agent is not uninstalled, a deleted user or computer will reappear in the dashboard with new data, and the license will be used again once the user is active. To stop collecting data for a user and prevent them from using a license, either place them on the Do Not Track list (best if multiple users share their computer, or if you only want to stop tracking the user temporarily), or, if no other users need to be tracked on that computer, uninstall the agent.
Old version of the agent
Verify that the computer for which you cannot see screenshots is on the latest agent version. You can check this in the Agent Version column on the Settings > Users & Groups > Computer Agents page. If running an outdated version, an Admin can download a new Agent directly from the dashboard, which always hosts the most recent version.
Antivirus and firewall settings
If security software, such as an antivirus or a firewall, is in place on the monitored machines, it may cause a conflict. Please review this article on allowlisting.
PC - unblock setting
On a PC, you may need to make sure the unblock property is set correctly for the installation file. Refer to these instructions.
Screenshot backlogs
Screenshots can serve as a backup if the internet connection is slow or lost. Screenshots are then captured on a computer, and they take some time to upload once the connection is restored. Screenshots may also be triggering faster than they are able to upload; if backlogs are occurring frequently, it can help to decrease the frequency of the alarms taking screenshots (for example, every 20 seconds instead of 10), and to ensure that you don't have multiple alarms enabled and triggering for the same activity.
If you are not part of the Agent Health Status, a member of our support team can help confirm if there is a backlog on the computer in question. If you have access to the computer, we can also help you check the local folders where screenshots are held before they are uploaded. For computers with a backlog, it is a good idea to restart the machines and then leave them powered on overnight or during off-work hours so they have a chance to catch up and clear out the backlog.
Mac - screenshots only contain the desktop background
If you are collecting screenshots for a Mac user and can only see their desktop background rather than the actual applications on their screen, this is due to Apple's Security & Privacy settings. You will need to follow these instructions. After completion, restart either the agent or the machine itself for the new screenshot permissions to take effect.
Frequently asked questions
How do screenshots work if a user has multiple monitors?
If multiple monitors are being used, they will all be visible in the screenshot.
What is the minimum amount of time allowed between multi-screenshots?
10 seconds
How do I configure an alarm to take random screenshots at regular intervals throughout the workday?
There is no way to capture screenshots at regular intervals while the user is logged in and working. This is because alarms are based on the active window, and each time a new site or application is accessed, the counter restarts and conditions are rechecked.
Is there anything important to know about macOS screen recording permissions?
Please refer to the following: