I have a laptop with an Office 365 company account. I work from home, but I obviously have some company policies running, since I get the 'Your administrator has blocked this action' messages in my Protection History.

Once in a while, I install software from Github on a second personal account on the same laptop. Somehow, the policies from my work account are still active on my personal account, because I get the same 'blocked' warnings.

The question is: if I override the block, by clicking "Allow it" - will my company be able to see this in a security report or a log file? In short, are they watching what I do - security wise?

  • 1
    In general, if the company owns the computer, or if you have let them install software on it, then assume they may know everything you are doing.
    – Anders
    Oct 20, 2022 at 11:34

1 Answer 1


Without knowing which programs are running in the background on your system, it's hard to tell. Usually additional software is needed for reporting security incidents, Windows doesn't do that on its own per default. However it does definitely log these events, probably in the Windows Defender logs you may find at

Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

in the Windows Event Viewer.

You are allowed another personal account on the same machine with what it seems like administrative privileges. So I doubt they actually care a lot about security related events on their devices. This is a very insecure setup on it's own in my humble opinion, creating security policies (implying some things are a big no-no) but then allowing the employee to override this with simply providing the password of another local admin account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .