I turned on my computer and came back after 30 minutes or so to let Norton
do its scans and so forth. When I tried to start working my computer was nearly
frozen, so I tried to shut it down. I got a message that said “There is another
user logged onto your computer if you terminate now they may lose there work” –
so I quickly powered off but What’s going on? this is a new problem and I have
never accessed nor anyone else from elsewhere.
Based on your description, I’d personally be concerned that your computer
had been infected with some kind of malware allowing remote control.
But before we jump to such an extreme conclusion, let’s take a look at just
what that message means, and what you might consider doing to determine exactly
what’s going on.
“There is another user logged onto your computer” can actually mean a couple
of different things.
Become a Patron of Ask Leo! and go ad-free!
If you run remote desktop sharing or terminal services, then someone may, in
fact, be logged into a separate session on your computer. This typically
requires Windows 2000 or 2003 server for true simultaneous multiple
sessions.
Fast user switching is another case where more than one person can be
“logged in” to your machine at the same time. Only one logged in user can
actually be seen and used, but the other remains logged in in the background.
In Windows, if you select “Switch User” when you Log Off, you’re not actually
logging off; instead, you’re simply putting the current user into the
background and logging in as a second user. Fast User Switching must be enabled
for this feature to work.
In both of the cases above, if you attempt to shut down your machine, you’ll
get the warning “There is another user logged onto your computer” because there
is. Either the remote desktop user, or the account that you switched away from.
Naturally shutting down the machine will force them to be logged off as
well.
The other common cause of this message is Windows file sharing on a local
area network.
If you create a file share on your system such that another machine can copy
file from, or possibly to, your machine, that creates a type of remote login.
Depending on your network and security settings, among other things, if machine
‘B’ is connected to a file share on machine ‘A’, then it is, in a sense “logged
in” to machine A. It’s a different type of login, but many of the same concepts
apply. Perhaps most importantly, much of the same security infrastructure
applies.
The net result is that if another machine on your network is accessing files
on your machine, then “There is another user logged onto your computer” may
result if you attempt to shut down your computer.
•
Now, those are all normal and typically benign reasons for the message. The
reason I’m concerned for your case is the high CPU usage or “frozen machine”
description you gave.
In a case such as this, the tool I’d reach for first is SysInternals Process Explorer. I’d do two things with
it.
First, after running it, I’d click on the CPU column to sort the process
list by who’s using the processor the most. Here’s an example:
Here you can see that the System Idle Process is taking up most of my CPU
time – meaning that most of the time my computer has nothing to do. Other
processes are listed in order of CPU usage. If you see a process pegged at the
top of that list taking most of your processor, then you have something to
investigate – what process is it, and why is it being such a hog.
scan, and in any case make sure that your firewall is working properly.”
While you’re in Process Explorer, there’s a quick way to see if more than
one user is actually logged in via remote desktop or fast user switching. Click
on the Process column heading and the process will be listed in “hierarchy”
order – meaning that each process will be listed indented from the process that
started it. Normally the list will start something like this:
If you look further down, you’ll see an instance of “explorer.exe” to the
far left:
“Explorer.exe” is your Windows user interface – the Start button,
the task bar and so on.
If you see more than once instance of Explorer.exe on the left, then more
than one account is logged in. You can examine the list of processes indented
beneath it – those are programs that this user is running. You can also use
“Properties” on the process to see what account is being used.
Now all these steps do is get you information. It’s quite possible that once
you see what’s running, you’ll say “oh yeah, that”, or you’ll Google up some
information that explains it.
On the other hand, this also might be a very good time to make sure that
Norton really is doing what it’s supposed to be doing, and is up to date.
Alternately, consider running an additional anti-virus or spyware scan, and in
any case make sure that your firewall is working properly.
Another way to tell if there is someone else logged on to your computer is with task manager.
In XP Home, there is a “users” tab that will tell you if there is someone else on using the fast user switching function.
Also, for all XP versions, under the processes tab, you can do a “view”=>”select columns” and check the “user name” column to display. Besides your name, you normally might see “system”, “local service” and “network service”. Also, certain services may run under alternate User Names. But you should be able to tell if there are any user names that are suspect.
I have 5 user accounts on this machine and even when they are all logged off, except for me, I still get that message shutting down. I just figured it’s a bug…I know there’s no remote sharing of any kind. It happens everytime I shut down or restart. I don’t worry about it.
lmao…I spoke too soon…..if I “log off” my account, I don’t get that get that message. You ever feel stupid after somethin you said?? lol
No one believes that it is possible for someone else to be loged on my computer. But then, where are all the music files coming from? Help!
if you have magic song files on your system you have been hacked. get a firewall and a good do an online scan from pest partol or panda.
I would like to put a friend of mine on MSN and he has given me permission to so hopefully I can do it and I don’t see why not. Please get back to me as soon as possible as it is really important that I get this account for him.
what is the ASP.net Isee in my users list? Can I delete it?
i’ve read the article above and it has been very helpful…i wanna ask one thing though, which is unrelated to this article but i’m hoping to find an answer here. i’m just wondering why spywares/malwares/trojan still get into a computer even if there is an anti-virus software already installed.
i hope you can solve my confusion on this one
tnx!
Hi! I have also had the message someone is logged onto your computer bla bla….. I suspect that someone is in my computer but i have ran the recommended checks and found nothing so far.Any more suggestions anyone?
Im gonna sound paranoid here but is it also true that your phone can be tapped using stealth software?
Download a utility called as psloggedon and you can figure out who has logged on to your system. you will get the software from microsoft technet.
How can I tell if someone has tried to use my computer? I am the only administrator, there isn’t any guest user either. Also, fi someone has tried to shut down my computer, how can i tell?
Sir,
In windows XP How to disable the message which pops up after clicking on turn off your computer (I have a remote desktop enabled on other computer.
Please reply.
Thank You.
I too have this problem on both Vista on my HP Desktop and my XP in my Dell notebook. On the HP Desktop it will not let me install a program called BalanceLog. The InstallShield Wizard says, “There are multiple users logged into your machine at the same time (fast-user switching). While BalanceLog works with this future, we requier all other Users be logged off when installing. Please log all users off and reboot your computer before running this installation.” My computer is not set up for other users to logon.
Maggie – did you figure out how to install BalanceLog? I am having the same problem installing it on my computer running Windows 7. Would love advice.
Thanks.
when m computer says you are being logged off because you have another user on your computer what does it mean and how can i find out names of people who are on my computer
How can I tell if someone has tried to use my computer? winxp
15-Sep-2011
I have found the Sysinternal processexplorer very help full Thank You Leo.
I am trying to prove who gets access to my computer can I trace back to the IP of the bandit who is getting into my computer . I know this because when closing down I am advised on the screen other users are logged in
No response required, just for your edification. I am in China and the government here has put something on my computer. It is always crashing and running out of memory. Usually comes up with the “other users” message when I reboot. Love to know how to block the bastards. They go home at 5 pm and suddenly everything works! Lovely country.
@Terry,
Try Ubuntu, they might not be able to get into that. You can try it out easily without even changing your operating system by booting your computer from a live CD. Here’s more:
What’s a live CD and why would I want one?
Thanks Connie, I will give it a shot.