How to trace a hidden desktop connection?

Question

Monitoring

A persistent suspicion began to appear that someone was connecting to the computer at work to the desktop and either taking screenshots, or simply observing, and there might be a keylogger for everything. Perhaps this is how the authorities try to control the work, or for some other purpose.
This is expressed by the fact that sometimes the desktop and all open windows begin to be updated constantly, as if they are being drawn on a new one, and this directly interferes greatly. It varies in duration and at different times. StaffCop did not find any third-party software or anything like it, I did not see any suspicious network connections (I looked, of course, because of my capabilities and knowledge), I did not find any services either.
I thought that somehow they get information through Kaspersky using an agent, but the last time a problem occurred, it was disabled.

Answer 1

sometimes the desktop and all open windows begin to be updated constantly, as if they are being drawn on a new one, and this really interferes a lot

and what, the processor is not loaded at this time?
Software in processes is always visible, for a keylogger you need to look for rootkits

Answer 2

Software in processes is always visible

No not always. Find a Stakhanovite agent :)
Maybe there is a keylogger there, of course - but clumsy. Or maybe the vidyuha is driving. If the system has a properly configured SMP agent, it is not so easy to find it (it is possible, of course, but not easy). However, if the SMP is working, they must warn about this when applying for a job.
And there is no "hidden connection". The agent sends to the server from time to time a snapshot of the desktop and a bunch of other information, including keyboard input :)

Answer 3

Fire up Wireshark and monitor the logs of where things go if you're bored. In general, for what purpose do you want to know this? For sport?
If you did not sign on the familiarization sheet when you were hired, that control of the employee’s work was established at the workplace, etc. etc. It doesn’t matter what screenshots they show or provide in which case. It will not carry any legal force.
If this prevents you from working, then talk to the administrator.