Guides

How to tell if someone is remotely accessing your computer

Updated November 2, 2026 · 3 min read

Remote-access software lets one computer control another over the internet. Help desks use it every day. So do scammers: the "tech support" caller who asks you to install a program so they can "fix" your PC is installing a door they can walk back through later.

Here is how to tell whether someone has a way into your Windows PC, and what to do if they do.

Signs to take seriously

• The mouse moves or windows open by themselves.
• You recently let someone connect to "fix" a problem after a phone call, pop-up or email.
• A program like AnyDesk, TeamViewer, ScreenConnect, UltraViewer, RustDesk or Splashtop is installed and you do not remember installing it.
• You get password-reset or sign-in alerts you did not cause.
• Your bank, email or social accounts show activity you did not do.
• Your antivirus was switched off and you did not do it.

Five places to check

1. Installed apps

Open Settings > Apps > Installed apps (on Windows 10, Apps & features) and sort by Install date. Look for remote-control tools, especially any installed around the time of a support call or a strange download. Legitimate tools become dangerous when someone else holds the login.

2. Services that run without you

Press Windows + R, type services.msc and press Enter. Remote-control tools set up for "unattended access" install a service that starts with Windows, so someone can connect even when nobody is signed in. Look for services named after remote tools with Startup type set to Automatic.

3. Remote Desktop

Windows has its own remote access. Open Settings > System > Remote Desktop. If you do not use it, it should be Off. (Home editions of Windows cannot accept Remote Desktop connections at all.)

4. User accounts

Open Settings > Accounts > Other users (on Windows 10, Family & other users). An account you did not create, especially one with administrator rights, is a serious sign. Attackers create extra accounts so they can get back in even if you remove their software.

5. Live connections

Press the Windows key, type resmon and press Enter. On the Network tab, the TCP Connections list shows which programs are talking to the internet right now. A remote-control tool connected while you are not using it means someone may be on the other end.

If you find something, do this now

1. Disconnect from the internet (unplug the cable or turn off Wi-Fi). This ends any live session immediately.
2. Uninstall the remote-control program and delete any account you did not create.
3. Change your passwords from a different device, such as your phone. Start with email (it can reset everything else), then banking, then everything else. Do not type new passwords on the PC until it is clean.
4. Call your bank if the person was ever connected while you had banking open, or if they asked you to sign in "to receive a refund". This is a common scam, and banks can often stop transfers if you call quickly.
5. Turn on two-step verification for email and banking.
6. Scan the PC, including a Microsoft Defender Offline scan (Windows Security > Virus & threat protection > Scan options).

How to avoid it next time

Microsoft, your bank and your internet provider will not call you out of the blue about a virus. A pop-up with a phone number is never a real warning. Hang up, close the pop-up (Ctrl + Alt + Delete, then Task Manager, then end the browser), and call the company back on a number you look up yourself.