How to tell if someone is remotely accessing your computer

• The pointer moves or clicks on its own, windows open or close, or text appears that you didn't type.
• A remote access app's icon appears next to the clock, or a notice on screen says a session is active.
• The PC shows the sign-in screen when you didn't lock it. On Pro editions, a Remote Desktop sign-in locks the screen at the PC.
• Apps, browser extensions or user accounts appear that you didn't add.
• Passwords stop working, or your security software has been switched off.

None of these proves it on its own: updates, sleep settings and ordinary apps cause some of them. The checks below tell you for sure.

1. 1

   Step 1: Look at the screen and the taskbar tray

   Click the arrow next to the clock to show every tray icon. Remote access and screen sharing apps almost always show an icon while they run, and many put a notice on the screen while someone is connected.

2. 2

   Step 2: Check Task Manager for remote access apps

   Press Ctrl+Shift+Esc. On Processes, look for remote access, remote support or screen sharing apps you don't recognize. Right-click one and choose Search online if you're not sure what it is. Then open Startup apps (the Startup tab on Windows 10) to see what starts with Windows.

3. 3

   Step 3: See who is signed in

   In Task Manager, open Users. Every signed-in account is listed, including one signed in over Remote Desktop. An account you don't expect, or a second session of yours, is worth a closer look.

4. 4

   Step 4: Check Remote Desktop and Remote Assistance

   On Pro editions, open Settings, then System, then Remote Desktop, and turn it off if you don't use it. Then press Windows+R, type SystemPropertiesRemote, and on the Remote tab untick Allow Remote Assistance connections to this computer unless you need it.

5. 5

   Step 5: Look at network connections

   Click Start, type Resource Monitor and open it. On the Network tab, expand TCP Connections: it lists which program talks to which address. Browsers, updates and cloud apps make plenty of connections; you're looking for a program you don't know with a steady connection. For the same list with program names in Command Prompt, run this as administrator:

   netstat -b -n

6. 6

   Step 6: Read the sign-in history in Event Viewer

   Open Event Viewer, go to Windows Logs, Security, and choose Filter Current Log. Enter 4624 for sign-ins: a Logon Type of 10 is a Remote Desktop sign-in. 4625 is a failed sign-in; many in a row from one network address means someone is guessing passwords.

   For Remote Desktop sessions in one place, open Applications and Services Logs, Microsoft, Windows, TerminalServices-LocalSessionManager, Operational. Event 21 is a session sign-in, and its Source Network Address says LOCAL for someone at the PC, or the address they connected from.

7. 7

   Step 7: Review apps and accounts

   In Settings, open Apps, then Installed apps, and sort by date installed. Then open Accounts and check the other users on the PC. Remove anything you didn't add and don't need.

8. 8

   Step 8: Run a full scan

   Open Windows Security, then Virus & threat protection, then Scan options, and run a Full scan. If something keeps coming back, run the offline scan from the same list, which checks the PC before Windows starts.

1. 1

   Step 1: Cut the connection

   Unplug the network cable or turn off Wi-Fi. That ends any remote session at once.

2. 2

   Step 2: Remove what they used

   Uninstall remote access software you didn't set up (Settings, Apps, Installed apps), switch off Remote Desktop and Remote Assistance if you don't use them, and remove user accounts you didn't create.

3. 3

   Step 3: Change your passwords from another device

   Start with your email, then banking and anything that pays for things. Turn on two-step verification where you can, and sign out of other sessions in each account's security settings.

4. 4

   Step 4: Call your bank if money was involved

   If you signed in to online banking or shared card details while they were connected, call the number on your card.

5. 5

   Step 5: Scan, update, and get help if unsure

   Run the full scan, install Windows updates, and have someone you trust look over the PC. If you can't be sure it's clean, back up your files and use Reset this PC (Settings, System, Recovery).

Finding a remote access app isn't always bad news. On a work PC, your IT team may use one to help you and keep the PC up to date, so ask them before removing anything. At home, a relative who helps with your PC may have set one up. Legitimate tools ask before they connect, or were switched on at the PC on purpose, and they show when someone is connected. If you don't know who set it up, treat it as unwanted.

RemoteAccessApp is built so nobody connects to a PC behind the back of the person using it. If it's on your PC, here's how to tell what's going on, and how to stop it:

• You're asked first. An Allow remote access? prompt names who wants to connect, and nothing is shown until you click Allow. If nobody answers in 45 seconds, the answer is no. The exceptions, unattended access and a permanent password, can only be switched on at the PC itself.
• A banner for the whole session. A Remote session active notice stays on the screen while anyone is connected, with small chips for what they're using, such as the screen, control or a command prompt. Its End session button disconnects everyone at once.
• View-only or quit, any time. In the tray menu, untick Allow remote control to make a session view-only, or choose Quit.
• A record on the PC. Session activity in the tray menu shows who connected and what happened, and Open activity log keeps the history.
• Trust you can take back. Trusted consoles and browsers lists everyone allowed in without a click, kept only on that PC. Removing one disconnects it at once.

Allow remote access?

RemoteAccessApp

Console

sam@LAPTOP-SAM

Console ID

3F2A 91C0 … 7B1D

They'll be able to see your screen and control this PC. Only allow it if you're expecting it.

Denied automatically in 25s if you don't answer.

Don't allowAllow

On a Linux PC, the banner has an End button, and on Wayland the desktop shows its own screen-sharing indicator too. What each person in a session can see, and what's stored afterward, is in remote desktop privacy: who can see what. Who may connect at all is covered in access control for your PCs and servers.