A method comprising: receiving, by a server device, a series of screen capture representations of a graphical user interface on a client device; determining a first active window for a first screen capture representation of the series and a second active window for a second screen capture representation of the series, wherein the first screen capture representation was screen captured by the client device at a first time and the second screen capture representation was screen captured by the client device at a second time, wherein the first screen capture representation comprises more than the first active window, and wherein determining the first active window comprises: sliding rectangular outlines of varying sizes (516, 518, 520) and larger than a nominally-sized rectangular outline over the first screen capture representation; identifying when one of the rectangular outlines surrounds four borders of a rectangular shape in the first screen capture representation; and determining that the rectangular shape is the first active window; identifying a first application associated with the first active window and a second application associated with the second active window based on textual and/or graphical characteristics of the first and second active windows, wherein the first application was executing in the first active window at the first time and the second application was executing in the second active window at the second time, and wherein at least one of the first application or the second application is a pre-determined target application; and determining that the first screen capture representation begins a contiguous subset of the screen capture representations, each containing respective first active windows, and determining that the second screen capture representation ends the contiguous subset of the screen capture representations, and determining, by the server device and based on the contiguous subset, an activity log for the client device, wherein the activity log identifies from the first time to the second time as an idle period or a busy period for the pre-determined target application. receiving, by a server device, a series of screen capture representations of a graphical user interface on a client device; determining a first active window for a first screen capture representation of the series and a second active window for a second screen capture representation of the series, wherein the first screen capture representation was screen captured by the client device at a first time and the second screen capture representation was screen captured by the client device at a second time, wherein the first screen capture representation comprises more than the first active window, and wherein determining the first active window comprises: sliding rectangular outlines of varying sizes (516, 518, 520) and larger than a nominally-sized rectangular outline over the first screen capture representation; identifying when one of the rectangular outlines surrounds four borders of a rectangular shape in the first screen capture representation; and determining that the rectangular shape is the first active window; sliding rectangular outlines of varying sizes (516, 518, 520) and larger than a nominally-sized rectangular outline over the first screen capture representation; identifying when one of the rectangular outlines surrounds four borders of a rectangular shape in the first screen capture representation; and determining that the rectangular shape is the first active window; identifying a first application associated with the first active window and a second application associated with the second active window based on textual and/or graphical characteristics of the first and second active windows, wherein the first application was executing in the first active window at the first time and the second application was executing in the second active window at the second time, and wherein at least one of the first application or the second application is a pre-determined target application; and determining that the first screen capture representation begins a contiguous subset of the screen capture representations, each containing respective first active windows, and determining that the second screen capture representation ends the contiguous subset of the screen capture representations, and determining, by the server device and based on the contiguous subset, an activity log for the client device, wherein the activity log identifies from the first time to the second time as an idle period or a busy period for the pre-determined target application.