Do you have your PC protected with an access password ? Is the computer used by several people and each has a corresponding user? How many local users do you have registered in Windows? These and other similar questions are of vital importance when it comes to clarifying if someone is entering your PC without you knowing .
You may have a curious roommate, a nosy family member, or a friend from work who for whatever reason is secretly using your computer when you’re not around. To know if this is the case, we are going to have to take a look at a few activity indicators, quite easy to check on the other hand.
Activity indicators in Windows
In the event that our PC uses the Windows operating system, the first thing we have to do is see if there is an intruder who is logging in with an unknown user, or even with our own user account (which is much more serious ).
1- Check for unknown logins
- Open Windows Explorer and navigate to the “C: \ Users \” folder.
- Here you will see a list of all users who have ever logged into the computer. Do you see any suspicious users?
If you do not see any external or unknown users, it is possible that the intruder is using your own user without your permission .
- Log into Windows with an alternate user account (this could be a new local user that you just created or an administrator user that you don’t use too much)
- Go back to the folder “C: \ Users \”.
- Look at your main user profile and look at the “Modification date” field. If the folder has been modifiedon a date when you have not used the PC, there you have the evidence you were looking for.
You can also go into your user profile folder and see if there are any subfolders or files that have been modified recently. If any date and time does not coincide with any time you have used the PC, that is a sign that someone is sneaking in with your user.
For example, if you work with your computer only in the mornings and you see that there are modified folders in the afternoon, that means that you probably have an infiltrator.
2- Take a look at the Windows event log
Checking the event log is a much more direct way to see if there has been activity on the PC at times when the computer should be off .
- Use the browser on the Windows taskbar and type “Event Viewer” to open the Windows Event Viewer.
- In the side panel click on “Windows Registries -> System”.
From here you just have to check the log to see if there has been any system activity at odd hours. Don’t worry, you don’t need to know what those records mean.
In my case, for example, I see that when the PC is turned off an event with source ID 107 “Kernel-Power” is generated, and when I turn it on again another event is generated with source ID 1 “Kernel-General”. Just look at the schedules and you can get a lot of clear information.
We see that the PC was turned off at 0:04 and that it was turned on again at 11:44
3- Check recent documents
If someone has been secretly using the PC, they have probably opened or edited a document. You can see all the recent files by simply opening the Windows file explorer, and clicking on ” Quick Access ” in the side menu on the left.
This will show us a list of recent files, which can give us quite a few clues about the existence of unauthorized activity on our PC.
4- Review your browsing history
Today much of the activity of a PC takes place on the Internet. Open all the web browsers that you have installed on your computer and take a look at the browsing history of each of them.
Unless they have cleared the history by hand or used an incognito tab, the evidence of the pages visited will be recorded.
5- Check the most common applications
Another thing you can do is open and review the programs you have installed on your PC. Many applications such as Word, Excel, VLC and others have a history of recent files.
Just try to open a new document in Word, or in VLC go to “Media -> Open Recent Media”. It can be a good way to detect recent activity on your computer.
6- Activity detection programs
If you don’t want to waste time checking all the applications one by one, you can also opt for the quickest solution, which is to install a free freeware program such as ExecutedProgramsList or LastActivityView .
These tools will make our work much easier, since their only task is to show in an orderly manner all the programs that have been executed on the PC.
After performing all these checks, it is likely that you already have more or less clear if your PC is being used by someone else in secret. If so, try to discuss it with the other person if possible, and make sure you always use a strong password to log into Windows.
