Abstract: A server device may receive a series of at least two screen capture representations of a graphical user interface on a client device. A first active window for a first screen capture representation of the series and a second active window for a second screen capture representation of the series may be determined. The first screen capture representation may have been screen captured by the client device at a first time and the second screen capture representation may have been screen captured by the client device at a second time. A first application associated with the first active window and a second application associated with the second active window may be identified, at least one of which may be a pre-determined target application. Based on the identified applications, an activity log for the client device may be determined.