How Does ActivTrak Determine Remote vs. Office Location?

ActivTrak Location Insights provides visibility into productivity metrics for hybrid, remote and in-office employees to enable informed decisions about hybrid work policies and office space requirements.

The Location Insights Dashboard breaks down employee location into three categories: Remote, Office and Office/Remote.

ActivTrak classifies as “Office” any location where multiple contributors from the same organization (users on the same ActivTrak account) work. Every other location is classified as “Remote.” (When an employee works in-office and remotely in the same day, with less than 80% of the day spent in either location, they are classified as “Office/Remote.”)

To determine that multiple individuals are co-located (classified as “Office”), we analyze their network signature by looking at their IP address and unique on-device signals. This approach allows ActivTrak to properly determine whether coworkers are physically co-located, even in scenarios where organizations use Virtual Private Networks (VPNs).

VPN Detection Details

Organizations use VPNs to secure access to particular systems by routing internet traffic through an office server first. This can cause remote workers to appear as though they are working from an office. However, since your network router is co-located with you, it won’t change when connected to a VPN, as an IP address does. ActivTrak differentiates between office and VPN activity by inspecting unique on-device signals in addition to IP addresses. 

For data privacy reasons, ActivTrak hashes these signals before processing or storage – we never know the original value. All that matters is whether it is unique (“Remote”) or shared (“Office”).

Explicit IP Assignment

For situations where employees routinely connect to the same IP address, such as an office or a VPN, Admins can label the IP address/range to ensure that associated user activity is always assigned the correct location.

From the ActivTrak app, navigate to the Insights Configuration page (Insights > Configuration). In the Assign IP Addresses to an Office Network or VPN setting, fill in the fields per the instructions below:

• IP address or range (subnet mask): IP4 addresses only
• Location Description: Select VPN or Office
• If Office is selected, activity on the associated IP address will always be classified as “Office.”
• If VPN is selected, activity on the associated IP will be classified according to the location detected (“Office” or “Remote”) using additional network attributes beyond IP address.
• IP Type: Select public (internet IP) or private (subnet IP)

Use the toggle below the list of manually assigned IP addresses to specify whether the list of Office IPs should be exhaustive or partial.

• If this toggle is turned on, only activity on manually assigned ‘Office’ IP addresses will be labeled ‘Office’ in the Location Insights Dashboard. User activity on all other IPs will automatically be labeled ‘Remote.’
• If the toggle is turned off, the Agent may automatically assign the ‘Office’ location to activity that takes place on other IP addresses, according to the location detection rules described in this article. (Activity on manually assigned ‘Office’ IPs will be labeled accordingly.)
• Location estimates for VPN activity are not impacted by the toggle. Whether the toggle is on or off, manually assigned VPNs will be labeled ‘Office’ or ‘Remote’ according to the location detection model. (Manually assigning the ‘VPN’ designation to an IP address ensures the accuracy of these predictions, because it indicates that the user’s location should be inferred from on-device signals rather than the IP address.)

Location History

Location history improves the accuracy of location estimates by “remembering” locations that have previously been identified as an office. If a critical mass of workers congregates at a location one day, we will retain that information and label the corresponding network signature an “Office” going forward, even on days when only one or two employees work from that location.

Location history only matches users against office clusters (multiple employees working from the same location) with strong signals. This determines which locations should be remembered as offices, and which should not. For instance, if a number of coworkers congregate at a coffee shop one day and log into their assigned computers, we’d identify that coffee shop as an “Office” for that day. But if a single employee returns to that location on future occasions, it wouldn’t make sense to classify their activity as taking place in an office.

This approach balances key location use cases:

• Auto-discovery of offices, especially those where IP addresses are unknown or change
• Remembering offices, even when they are sparsely populated on some days
• Forgetting temporary offices to limit false positives

Remote and Terminal Servers

Location can be determined for users connected to Windows Remote Desktop (RDP) and Citrix environments (via XenDesktop or XenApp). If the ActivTrak software is installed on the user’s local device (most commonly in a Remote location), we will ignore the terminal server location and accurately predict the true location of the user for the entire working session. If the ActivTrak agent is not installed on the local device, we will default the location prediction to ‘Remote’ – the most common case.

Future releases may include location estimates for other remote desktop protocols.

Learn more:

• Location Insights Dashboard
• Hybrid Work: Determining Employee Work Location in a Privacy-Centric Way
• Insights Configuration
• What Data Does ActivTrak Collect?