I turned on my computer and came back after 30 minutes or so to let Norton
do its scans and so forth. When I tried to start working my computer was nearly
frozen, so I tried to shut it down. I got a message that said “There is another
user logged onto your computer if you terminate now they may lose there work” –
so I quickly powered off but What’s going on? this is a new problem and I have
never accessed nor anyone else from elsewhere.
Based on your description, I’d personally be concerned that your computer
had been infected with some kind of malware allowing remote control.
But before we jump to such an extreme conclusion, let’s take a look at just
what that message means, and what you might consider doing to determine exactly
what’s going on.
“There is another user logged onto your computer” can actually mean a couple
of different things.
Become a Patron of Ask Leo! and go ad-free!
If you run remote desktop sharing or terminal services, then someone may, in
fact, be logged into a separate session on your computer. This typically
requires Windows 2000 or 2003 server for true simultaneous multiple
Fast user switching is another case where more than one person can be
“logged in” to your machine at the same time. Only one logged in user can
actually be seen and used, but the other remains logged in in the background.
In Windows, if you select “Switch User” when you Log Off, you’re not actually
logging off; instead, you’re simply putting the current user into the
background and logging in as a second user. Fast User Switching must be enabled
for this feature to work.
In both of the cases above, if you attempt to shut down your machine, you’ll
get the warning “There is another user logged onto your computer” because there
is. Either the remote desktop user, or the account that you switched away from.
Naturally shutting down the machine will force them to be logged off as
The other common cause of this message is Windows file sharing on a local
If you create a file share on your system such that another machine can copy
file from, or possibly to, your machine, that creates a type of remote login.
Depending on your network and security settings, among other things, if machine
‘B’ is connected to a file share on machine ‘A’, then it is, in a sense “logged
in” to machine A. It’s a different type of login, but many of the same concepts
apply. Perhaps most importantly, much of the same security infrastructure
The net result is that if another machine on your network is accessing files
on your machine, then “There is another user logged onto your computer” may
result if you attempt to shut down your computer.
Now, those are all normal and typically benign reasons for the message. The
reason I’m concerned for your case is the high CPU usage or “frozen machine”
description you gave.
In a case such as this, the tool I’d reach for first is SysInternals Process Explorer. I’d do two things with
First, after running it, I’d click on the CPU column to sort the process
list by who’s using the processor the most. Here’s an example:
Here you can see that the System Idle Process is taking up most of my CPU
time – meaning that most of the time my computer has nothing to do. Other
processes are listed in order of CPU usage. If you see a process pegged at the
top of that list taking most of your processor, then you have something to
investigate – what process is it, and why is it being such a hog.
scan, and in any case make sure that your firewall is working properly.”
While you’re in Process Explorer, there’s a quick way to see if more than
one user is actually logged in via remote desktop or fast user switching. Click
on the Process column heading and the process will be listed in “hierarchy”
order – meaning that each process will be listed indented from the process that
started it. Normally the list will start something like this:
If you look further down, you’ll see an instance of “explorer.exe” to the
“Explorer.exe” is your Windows user interface – the Start button,
the task bar and so on.
If you see more than once instance of Explorer.exe on the left, then more
than one account is logged in. You can examine the list of processes indented
beneath it – those are programs that this user is running. You can also use
“Properties” on the process to see what account is being used.
Now all these steps do is get you information. It’s quite possible that once
you see what’s running, you’ll say “oh yeah, that”, or you’ll Google up some
information that explains it.
On the other hand, this also might be a very good time to make sure that
Norton really is doing what it’s supposed to be doing, and is up to date.
Alternately, consider running an additional anti-virus or spyware scan, and in
any case make sure that your firewall is working properly.