Think someone went through your laptop at work?

WindowsMacUpdated

You come back from a meeting and something's off: a window you didn't open, a file that's moved, the laptop awake when you left it asleep. If you think someone went through your laptop at work, take a breath, note what you noticed, check your work account's sign-in activity, and tell IT. Then make locking the screen a habit.

Quick answer

Lock your screen every time you leave your desk: Windows logo key + L on Windows, Control-Command-Q on a Mac. Check your work account's sign-in activity at myaccount.microsoft.com if your workplace uses Microsoft 365. Write down what you noticed and when, and raise it with IT or your manager. Don't install anything on a work laptop without IT's agreement.

How do I lock my work laptop quickly?

Use the keyboard shortcut as you stand up. It takes a second and means anyone who sits down needs your password. Microsoft lists Windows logo key + L as the shortcut to lock the computer, and Apple lists Control-Command-Q to lock your Mac's screen.

  1. Windows: press Windows logo key + L. You can also press Ctrl + Alt + Delete and choose Lock.
  2. Mac: press Control-Command-Q.

If the laptop was left unlocked, anyone using it would have been signed in as you. That's worth knowing before you look at any records, because they'll show your account either way.

Can I make it lock on its own?

Yes, on both. On Windows, Dynamic lock uses your phone's Bluetooth connection to lock the PC when you walk away. On a Mac, Lock Screen settings ask for your password after the screen saver starts or the display turns off. Microsoft notes that some settings may vary with how your device is set up, so a work laptop may have these fixed by IT.

Windows

  1. Pair your phone with the PC over Bluetooth.
  2. Go to Settings > Accounts > Sign-in options.
  3. Under Additional settings, turn on Dynamic lock. Microsoft says Windows locks within a minute after you're out of Bluetooth range.

Mac

  1. Choose Apple menu > System Settings, then click Lock Screen.
  2. Set "Require password after screen saver begins or display is turned off" to a short time.
  3. Choose a short time for the display to turn off when inactive.

Can I see if someone signed in to my work account?

You can see sign-ins to your account, which isn't quite the same as seeing who used the laptop. If your workplace uses Microsoft 365, Microsoft's My Sign-ins page lists recent sign-ins with details such as location, operating system, browser and app.

  1. Go to myaccount.microsoft.com and sign in with your work account.
  2. Choose Recent Activity in the left-hand menu.
  3. Expand each sign-in and check you recognise it.
  4. If a successful sign-in wasn't you, Microsoft says to change your password straight away and then update your security info.

If someone used your laptop while it was already unlocked, they didn't need to sign in, so this page may show nothing new. For what the laptop itself records, see our guides on how to tell if someone used your laptop and how to see who logged into your computer. On a work laptop, some of those tools may be restricted, which is another reason to involve IT.

Should I tell IT or HR?

Telling IT is a sensible first step. A work laptop belongs to your employer, and IT usually has records and tools you don't. Microsoft's Intune documentation, for example, says that on a company-owned Windows device managed this way, the organisation can query details including event log entries. IT can look properly without you having to guess.

  1. Write down what you noticed, the date and roughly when you were away.
  2. Don't delete or tidy anything first. Leave things as they are.
  3. Contact IT, or your manager if that's the route your workplace uses.
  4. If the concern is about a person's behaviour rather than a security problem, HR is the right place, and IT can still help with the technical side.

Keep it factual: describe what you saw and when, rather than who you think it was.

What can my employer see on my work laptop?

That depends on how the laptop is managed, so ask IT if you want to know. As one example, Microsoft says that when a device is enrolled in Intune, the organisation can't see your browsing history, emails, passwords, photos or the content of documents you create, but can always see details such as the device name, model, serial number and operating system.

On a Mac, choose Apple menu > System Settings > General > Device Management to see any configuration profiles your employer has installed. Apple says that if you can't remove a profile, ask the person who provided it.

Can I install something to see who uses my work laptop?

Not without IT's agreement. A work laptop is your employer's device, and installing software on it without permission may go against your workplace's rules. Ask first, explain what happened, and let IT decide. They may have a better option already.

The same goes the other way: please don't go through a colleague's computer to find out what happened. Report it and let IT or HR look.

Where Failshot fits

Failshot is for your own devices. On a work laptop, use it only if IT agrees.

With Failshot on, it photographs whoever unlocks your Mac or Windows laptop, and the camera light shows each time it takes a photo. It doesn't take wrong-password photos at the Windows sign-in screen. Someone who knows your password can't switch it off: that needs Touch ID on a Mac where available, or your own Failshot PIN plus your answer, and a wrong Failshot PIN takes another photo. Photos stay on your device, with optional email alerts that send the photo and the time. When you switch it off yourself, the photo of your own unlock is deleted. Out now for Mac, with Windows to follow.

Questions people also ask

What is the shortcut to lock a computer?

On Windows, press Windows logo key + L, which Microsoft lists as the shortcut to lock the computer. On a Mac, press Control-Command-Q, which Apple lists as the shortcut to lock your screen. Either one means the next person needs your password.

Can I tell if a colleague used my computer while it was unlocked?

Not easily from sign-in records, because an unlocked laptop needs no new sign-in and any activity looks like yours. Recent files and browser history may help. The clearest route is to tell IT what you noticed and when, and lock the screen from now on.

Can I check my work account's sign-in history?

If your workplace uses Microsoft 365, go to myaccount.microsoft.com, sign in with your work account and choose Recent Activity. Microsoft says to change your password straight away if a successful sign-in wasn't you. Some workplaces use other systems, so ask IT.

Can my employer read my emails on a work laptop?

It depends on the tools your workplace uses. Microsoft says an organisation can't see email and text messages, browsing history or passwords on a device enrolled in Intune, but other systems may differ. Your IT team can tell you what applies to your laptop.

Sources