Monitor people who use my computer

"This is a security measure? I'm pretty sure that's closer to an insecure measure. It breaks authenticity and non-repudiation (I think, sometimes a little fuzzy on that one).

Story from a professor: He was in the military before become a prof. He had a guy under him who refused to lock his workstation when he got up, even though it was policy and had been repeatedly warned. One day the guy got up and left and it was unlocked. The prof then went to the guys workstation and wrote an e-mail to himself (so it would look like it came from the guy to the professor). The e-mail was really blistering, chewing him up and down, swearing, etc. The guy gets back and the prof tells him to come into his office immediately and then shows him the e-mail. Of course, it all looks like it came from the guy and he's scared, bad. Finally the prof told him what happened and the guy locked his workstation after that.

So, you should approach whoever designed this ""security policy"" and maybe talk it out with them. It could really be potentially harmful. Not to mention if other people besides IT have acess to your area (cleaning crew, visitors, etc.), any of them could potentially surfing any site or sending out e-mails or browse company data to which they shouldn't have access."

"You could run a keylogger or something similar, but if they're paranoid and checking your computer regularly there is a chance they'll find it and write you up for that. If it's a company computer and they want to inspect it, they probably have a right to do that (IANAL and this may change depending on your contract with them, if any, and whether data on the work computer is covered under a ""reasonable expectation of privacy"" and such). If you're doing your job and not breaking company policy regarding the use of their computer, why do you care if they inspect it?

As for leaving the desktops unlocked, it sounds like they could get better security by running centralized authentication with a master administrator account that can log in to any of the computers without requiring them to be left logged in all the time."