Are the remote locations/home machines owned by your company or personal computers? If its a personal computer I believe its not something you can probably avoid since, worst case scenario, they can do screenshots and print that. in other hand if its a company computer you can implement some restrictions to what can be installed (e.g. home printers) and connected (e.g. usb sticks). Still not foul proof since you can take a pic of whatever you're seeing. regarding splunk logging you can check windows eventlog and even make it, using GPO, more verbose to include logs that might give you a hint of what employees are doing (e.g. printing, copying, fs changes, etc) ... View more

use client_IP on netScaler to track this information, it will be recorded in syslog which can be sent to SPLUNK,use client_IP ... View more