Track activity of my account in GoTo Admin
Use the activity tab to view granular information about changes that have occurred in your account, who made the change, and when.
Before you begin: You must be assigned an admin or Super admin
role to perform this task.
The Activity Log helps you meet compliance requirements and track the changes made to your devices. See
what logs you can get in
LogMeIn Resolve.
- From
Home > Activity > 
> + Add filter to filter by date, admin, activity type and/or status.
For information on available filters, see Filter your account's activities
Log events provided by LogMeIn Resolve
All log events contain the name of the affected
LogMeIn Resolve entity, such as the device, device group, or session. The following log events are available on your account:
| Event name | Description | Applies to |
|---|---|---|
| Terminal session started | A terminal session was started in a device. | single device |
| File manager session started | A file manager session was started in a device. | single device |
| Registry editor session started | A registry editor session was started in a device. | single device |
| BitLocker key recovery started | A BitLocker key recovery was started in a device. | single device |
| Service manager session started | A service manager session was started in a device. | single device |
| Device removed | A device was removed. | single device |
| Device labels changed | The labels were changed in a device. | single device |
| Device verification lost due to downgrading | A subscription plan was changed that moved the device to unverified status. | single device |
| Device name updated | The name of the device was updated. | single device |
| Device installed | A device was installed. | single device |
| Device force installed | A device was force installed. | single device |
| Machine scan started | A user started a machine scan for Windows and third-party app updates. | single device |
| Created backup policy | A backup policy was created. | single/multiple devices |
| Updated backup policy | A backup policy was modified. | single/multiple devices |
| Deleted backup policy | A backup policy was deleted. | single/multiple devices |
| Deactivated backup policy | A backup policy was deactivated. | single/multiple devices |
| Reactivated backup policy | A backup policy was reactivated. | single/multiple devices |
| Device added to device group | A device was added to a device group. | single device |
| Device removed from device group | A device was added to a device group. | single device |
| Device verified | A device was verified. | single device |
| Created device group | A device group was created. | single device group |
| Deleted device group | A device group was deleted. | single device group |
| Changed device group | A device group was changed. | single device group |
| Process shut down started | A process termination action was started from the Device details page. | single device |
| Reboot started | A reboot action was started from the side panel of the Devices page. | single device |
| Event name | Description | Applies to |
|---|---|---|
| User added to device group | A user was added to a device group. | single device group |
| User removed from device group | A user removed a user from a device group. | single device group |
| User group added to device group | A user group was added to a device group. | single device group |
| User group removed from device group | A user group was removed from a device group. | single device group |
| Event name | Description | Applies to |
|---|---|---|
| Update schedule created | A user started the schedule of a Windows or third-party app update jobs for devices. | single/multiple devices |
| Update schedule cancelled | A user cancelled a scheduled update job. | single/multiple devices |
| Created Windows update policy | A Windows update policy was created. | single/multiple devices |
| Updated Windows update policy | A Windows update policy was modified. | single/multiple devices |
| Deleted Windows update policy | A Windows update policy was deleted. | single/multiple devices |
| Deactivated Windows update policy | A Windows update policy was deactivated. | single/multiple devices |
| Reactivated Windows update policy | A Windows update policy was reactivated. | single/multiple devices |
| Event name | Description | Applies to |
|---|---|---|
| Alert policy created | An alert policy was created. | devices or device groups |
| Alert policy modified | An alert policy was modified. | devices or device groups |
| Alert policy activated | An alert policy was activated. | devices or device groups |
| Alert policy deactivated | An alert policy was deactivated. | devices or device groups |
| Alert policy deleted | An alert policy was deleted. | devices or device groups |
| Event name | Description | Applies to |
|---|---|---|
| Zero trust hard reset | All zero trust keys were reset. | N/A (company-wide) |
| Zero trust key changed | A zero trust key was changed. | N/A (same user) |
| Zero trust recovery key used | A zero trust key was recovered | N/A (same user) |
| Signature key created | The first signature key was created | N/A (same user) |
| Signature key revoked | The signature keys of user were revoked by another user. | user belonging to keys being revoked |
| Signature key submitted for approval | A new signature key was sent for approval. | N/A (same user) |
| Request for signature key approved | A signature key was approved. | user belonging to key being approved |
| Request for signature key rejected | A signature key was rejected. | user belonging to key being rejected |
| Recovery key created | A recovery key was created. | N/A (same user) |
| Event name | Description | Applies to |
|---|---|---|
| Created Endpoint Protection policy | An Endpoint Protection policy was created. | single/multiple devices |
| Updated Endpoint Protection policy | An Endpoint Protection policy was modified. | single/multiple devices |
| Deleted Endpoint Protection policy | An Endpoint Protection policy was deleted. | single/multiple devices |
| Deactivated Endpoint Protection policy | An Endpoint Protection policy was deactivated. | single/multiple devices |
| Reactivated Endpoint Protection policy | An Endpoint Protection policy was reactivated. | single/multiple devices |
| Event name | Description | Applies to |
|---|---|---|
| Created remote execution job | A Remote Execution job was created. | single/multiple devices |
| Created remote execution template | A Remote Execution template was created. | N/A (template without assignment) |
| Updated remote execution template | A Remote Execution template was modified. | N/A (template without assignment) |
| Deleted remote execution template | A Remote Execution template was deleted. | N/A (template without assignment) |
| Remote execution job started | A Remote Execution job was started. | single/multiple devices |
| Remote execution job failed | A Remote Execution job failed. | single/multiple devices |
| Remote execution job successful | A Remote Execution job was successfully ran. | single/multiple devices |
| Event name | Description | Applies to |
|---|---|---|
| Quick scan started | A quick scan for a device or multiple devices was started. | single/multiple devices |
| Full scan started | A full scan for a device or multiple devices was started. | single/multiple devices |
| Firewall turned on | The firewall was turned on for a device or multiple devices. | single/multiple devices |
| Firewall turned off | The firewall was turned off for a device or multiple devices. | single/multiple devices |
| Real-time protection turned on | Real-time protection was turned on for an antivirus solution on a device or multiple devices. | single/multiple devices |
| Virus definition database updated | A user started to update the virus definition database for an antivirus solution on a device or multiple devices. | single/multiple devices |
| Resolve Endpoint Protection installed | A user started to install Resolve Endpoint Protection for a device or multiple devices. | single/multiple devices |
| Event name | Description | Applies to |
|---|---|---|
| Created incident | An incident was created. | single incident |
| Updated incident | An incident was modified. | single incident |
| Deleted incident | An incident was deleted. | single incident |
| Merged incident | An incident was merged. | single incident |
| Incident linked to problem | An incident was linked to a problem. | single incident |
| Incident and problem unlinked | An incident was unlinked from a problem. | single incident |
| Comment added to incident | An incident comment was created. | single incident comment |
| Comment updated | An incident comment was modified. | single incident comment |
| Comment deleted | An incident comment was deleted. | single incident comment |
| Incident followers updated | An incident's followers were modified. | single incident |
| Incident labels updated | An incident's labels were modified. | single incident |
| Incident relation updated | An incident's relation was modified. | single incident |
| Event name | Description | Applies to |
|---|---|---|
| Remote control session started | A support session started on an unattended device. | support session/single device |
| Instant support session started | A support session started on an attended device. | support session |
| Instant support session started on mobile device | A support session started on a mobile device. | support session |
| Camera share session started | A support session started with camera share. | support session |
| Agent joined support session | An agent joined to the support session. | support session |
| Agent force connected to support session | An agent force connected to the support session. | support session |
| End-user accepted agent joining the support session | An end-user accepted the agent to join an unattended support session. | support session |
| End-user declined agent joining the support session | An end-user declined the agent from joining an unattended support session | support session |
| End-user joined support session | An end-user joined the support session. | support session |
| Support session ended | The support session ended. | support session |
| Agent invited another agent to join support session | The agent invited another agent to the support session. | support session |
| Support session transferred to another agent | The support session was transferred to another agent. | support session |
| Requested remote view | Remote view was requested in support session. | support session |
| Remote view request accepted | A remote view request was accepted in a support session. | support session |
| Remote view request declined | A remote view request was declined in a support session. | support session |
| Requested remote control | Remote control was requested in a support session. | support session |
| Remote control request accepted | A remote control request was accepted in a support session. | support session |
| Remote control request declined | A remote control request was declined in a support session. | support session |
| Applet download started | An applet download started in a support session. | support session |
| Agent file transfer finished | An agent finished file transfer in a support session. | support session |
| End-user file transfer finished | A customer file transfer finished in a support session. | support session |
| File manager opened | A file manager was opened in a support session. | support session |
| Device reboot started in session | A device reboot started in a support session. | support session |
| Safe reboot started in session | Tracks device safe reboot started in support session | support session |
| Snapshot taken in session | A snapshot was taken in a support session. | support session |
| Clipboard sync turned on | An agent turned clipboard sync on in a support session. | support session |
| Clipboard sync turned off | An agent turned off clipboard sync in a support session. | support session |
| Agent started screen sharing | An agent started screen share in a support session. | support session |
| Agent stopped screen sharing | An agent ended screen share in a support session. | support session |
| Agent started screen blanking | An agent started screen blank in a support session. | support session |
| Console disconnected from support session | A console disconnected from a support session. | support session |
| Client disconnected from support session | A client disconnected from a support session. | support session |
| Admin mode turned on successfully | An admin mode elevation succeed in a support session. | support session |
| Turning on admin mode unsuccessful | An admin mode elevation failed in a support session. | support session |
Filter your account's activities
Admins can select
Add filter at the top of the page to filter
LogMeIn Resolve events as follows:
- Initiated by: Select a user from your account to view the actions and events performed by that user. You can filter by one user at a time.
- Activity type: Select the type of activity or event that you want to display. This includes general activities, such as adding users, as well as events specific to LogMeIn Resolve. Multiple activities and events can be filtered simultaneously.
- Applies to: Select the devices for which you want to list events.
- Status: Filter by event outcome by selecting either Successful or Failed activities.
Frequently Asked Questions
- Can I see events from 2024?
- No. LogMeIn Resolve started logging events on March 15, 2025. You can only view events that occurred afterwards.
- Can I export the log to Excel?
- Not yet. This feature will be part of a future release.
- Can I export the log to CSV?
- No.
- Are events localized in GoTo Admin?
- Yes. Events are available in all languages available in LogMeIn Resolve: English, German, French, Italian, Spanish, and Brazilian Portuguese.
Article last updated: 8 July, 2025