Who connected to your company computer?
Find a connection, identify the initiating account and follow the session’s events. How to use Remoqa’s company event log, filters and Excel export.
The short version
Choose the company computer and date range, then open the events for one session. Check whether the connection actually started and which account initiated it.
A colleague asks who connected to the accounts computer yesterday afternoon. You need to find the workstation, distinguish a request from an established session and see the account behind it. Remoqa’s connection history and organisation event log answer different parts of that question. Here is where to look and how to read what you find.
Choose the right history
“History” in your account shows sessions initiated by your account or involving your personally linked devices. Filter by device, direction and status to review an incoming connection or one of your own support sessions. Availability and the period shown depend on your plan.
For a company-wide review, open the organisation’s Extended audit. It records incoming and outgoing connections involving devices in that organisation, including connections by external users and people who have not signed in. It also records changes to members, permissions, invitations, devices and departments.
Enable collection before you need it
New organisation events are collected while the creator’s account has an active paid Team plan and the Extended audit add-on is active. The organisation’s creator manages activation and billing. An assigned role and an active add-on are separate requirements.
To view the log and export it, a member needs a verified email address and the Extended audit or Owner role. Roles are cumulative: Extended audit also grants device and department editing. Keep this in mind when choosing who should review the log.
Open “Devices”, then “Control panel”, choose the organisation and its “Audit” tab. Check for “Events are being recorded”. Add the computer to the organisation and enable collection before the sessions you want to review; earlier events cannot be recovered.
Find yesterday’s connection
Start with the computer and an approximate time. For example, to review yesterday’s help with an invoice, narrow the log to the accounts workstation before searching for a particular colleague.
- Choose the dates
Set “From date” and “To date”. The end date includes that whole day. Dates follow the browser’s time zone, so check the zone when comparing the log with a support ticket.
- Find the computer
In “Device”, enter its organisation name or Remoqa ID. A name fragment works; the ID is useful when several workstations have similar names.
- Apply the filters
Choose an event type if you need one, then select “Apply”. To find established sessions, use “Session started”. Leave the event filter open when you need to see requests that failed or were rejected.
- Check the operator
The entry shows the recorded initiating account’s name and email when available. Use “Operator” to narrow the results by name or email.
- Open the whole session
Select “Events for this session” on an entry to follow that session within the selected organisation. Use “Reset” to return to the wider log.
Follow the session’s sequence
A request alone does not show that someone reached the desktop. Read the lifecycle entries together, including the result shown for an ended session.
The Operator field identifies the initiating account, not necessarily the person physically using it. A signed-out initiator appears as “Guest”, without an account email. External operators can appear in the company log without being organisation members. Give technicians their own accounts to make later reviews clearer.
File transfer entries are client reports. They can include a reported byte count, but contain no file names or contents and do not prove that a particular file was delivered. Confirm receipt with the recipient. The event log does not record screen video or every action taken on the desktop.
- Connection requested
A connection attempt was created. It may still be waiting for approval or may end without becoming an active session.
- Session started
The session reached the started state. Use this alongside the operator and computer details when checking who connected.
- Session ended
Read the result: the attempt or session ended, failed or was rejected. An ended entry can exist without an earlier successful start.
Export the relevant records
Set the filters, then select “Export to Excel”. The XLSX file includes all matching records, including those beyond the visible page. It contains the time, event, operator, email, device, Remoqa ID, session identifier and event details.
The date column names the time zone used for the export. Keep that context when handing the file to another colleague or comparing it with a ticket. A filtered export lets the next reviewer follow the same connection without searching the whole log.
Events are retained for one year from recording. If the Team plan or audit add-on expires, new collection pauses; authorised members can still view and export saved events until their retention period ends.
When the expected event is missing
Check the selected organisation, device name or ID, dates and time zone. Use “Reset” to clear an operator, event or single-session filter that may be hiding the entry.
Check whether the computer belonged to the organisation and collection was active when the connection was requested. Enabling the add-on later does not fill earlier gaps. Events outside the retention period are also unavailable, so an empty result alone does not establish that nobody connected.
If a connection is unfamiliar, compare its time, account and session events with your support records and ask the responsible colleague. Review permissions when duties change. Removing a member from the organisation’s directory is separate from ending active sessions and changing permanent passwords that person knew.