Living Breathless

How to Check if Someone Logged into Your Windows PC Remotely

Written by

Oliver

in

Finding out if someone has accessed your Windows PC remotely without your permission is a serious concern. Remote access allows another person to control your computer from a different location, potentially leading to data theft, privacy breaches, or system changes. Knowing how to check for such activity is important for your digital security. This guide will show you several ways to investigate remote logins on your Windows computer.

Understanding Remote Access on Windows

Before we dive into how to check, it helps to know how remote access typically works on Windows. The most common built-in method is Remote Desktop Protocol (RDP). RDP is a Microsoft protocol that allows a user to connect to another computer over a network connection. When enabled, it lets someone see and control your desktop from afar. Other methods might include third-party remote access software like TeamViewer or AnyDesk, or even malicious software that creates a backdoor.

Method 1: Using Event Viewer to Check Login Records

The Event Viewer is a built-in Windows tool that records significant events on your computer, including login attempts. This is one of the most reliable ways to see who has accessed your PC and when.

Steps to Use Event Viewer:

  1. Open Event Viewer:
    • Press Windows key + R to open the Run dialog.
    • Type eventvwr.msc and press Enter.
  2. Navigate to Security Logs:
    • In the left-hand pane of Event Viewer, expand “Windows Logs”.
    • Click on “Security”.
  3. Filter for Login Events:
    • In the right-hand “Actions” pane, click on “Filter Current Log…”.
    • In the “Filter Current Log” window, look for the “Event IDs” field.
    • Enter the following Event IDs to filter for specific login types:
      • 4624: This ID indicates a successful login.
      • 4625: This ID indicates a failed login attempt.
      • 4648: This ID indicates a logon using explicit credentials (e.g., Run as different user).
      • 4778: This ID indicates a Remote Desktop Services session reconnected.
      • 4779: This ID indicates a Remote Desktop Services session disconnected.
      • 1149: This ID indicates a Remote Desktop Services user authentication.
    • Click “OK” to apply the filter.
  4. Review the Events:
    • Now, you will see a list of login and remote connection events.
    • Double-click on an event to see more details.
    • Look for events with “Logon Type: 10”. This “Logon Type” specifically refers to RemoteInteractive logins, meaning someone logged in remotely through services like RDP.
    • Also, check the “Source Network Address” field within the event details. This will show the IP address from which the login originated. If you see an IP address that you don’t recognize or that isn’t from your local network, it could indicate unauthorized remote access.

Method 2: Checking Your Microsoft Account Sign-in Activity

If you use a Microsoft account to log into your Windows PC, you can check its recent sign-in activity online. This won’t directly show RDP logins to your local machine, but it can indicate if your Microsoft account itself has been compromised and used to access other Microsoft services, which might be a precursor to PC access.

Steps to Check Microsoft Account Activity:

  1. Go to Microsoft Account Security:
    • Open your web browser and go to account.microsoft.com/security.
  2. Sign In:
    • Sign in with your Microsoft account credentials.
  3. View Activity:
    • Click on “Review recent activity” under the “Sign-in activity” section.
    • Here, you will see a list of successful and unsuccessful sign-ins to your Microsoft account, including the location, date, time, and IP address. Look for any suspicious entries.

Method 3: Using the netstat Command (Advanced)

The netstat command in the Command Prompt can show active network connections on your PC. While it won’t show past remote logins, it can help identify ongoing unauthorized connections.

Steps to Use netstat:

  1. Open Command Prompt as Administrator:
    • Type cmd in the Windows search bar.
    • Right-click on “Command Prompt” and select “Run as administrator”.
  2. Run the netstat command:
    • Type netstat -ano and press Enter.
    • This command shows all active connections (-a), numeric addresses (-n), and the Process ID (PID) of the process that opened the connection (-o).
  3. Identify Suspicious Connections:
    • Look for connections with a “Foreign Address” that you don’t recognize.
    • Pay attention to connections on common remote access ports, such as port 3389 (for RDP).
    • The “State” column shows the connection status (e.g., ESTABLISHED, LISTENING). An “ESTABLISHED” connection to an unfamiliar foreign address can be a red flag.
    • You can then use the PID to identify the process using Task Manager (Ctrl + Shift + Esc, go to the “Details” tab and sort by PID) to see which program is behind the connection.

Method 4: Checking for Unknown User Accounts

Unauthorized remote access might involve the creation of a new user account on your PC to maintain persistent access.

Steps to Check User Accounts:

  1. Open Computer Management:
    • Right-click on the Start button and select “Computer Management”.
  2. Navigate to Local Users and Groups:
    • In the left-hand pane, expand “Local Users and Groups”.
    • Click on “Users”.
  3. Review User Accounts:
    • Examine the list of user accounts. Look for any accounts you don’t recognize or that you didn’t create. If you find one, delete it immediately after confirming it’s not a legitimate system or application account.

Method 5: Reviewing Remote Desktop Settings

If Remote Desktop is enabled on your system without your knowledge, it makes your PC vulnerable.

Steps to Check Remote Desktop Settings:

  1. Open System Properties:
    • Right-click on “This PC” (or “My Computer”) and select “Properties”.
    • Click on “Remote settings” in the left-hand pane.
  2. Check Remote Desktop Status:
    • In the “Remote” tab, check the “Remote Desktop” section.
    • If “Allow remote connections to this computer” is selected and you didn’t enable it, or if it’s set to allow connections from any version of Remote Desktop (less secure), consider disabling it or setting it to a more secure option.

What to Do If You Find Unauthorized Access

If you discover evidence of unauthorized remote access:

  • Disconnect from the Internet: Immediately unplug your Ethernet cable or disable Wi-Fi.
  • Change All Passwords: Change passwords for your Windows user account, Microsoft account, email, banking, and any other important online services. Use strong, unique passwords.
  • Run a Full Antivirus Scan: Use reputable antivirus software to perform a deep scan for malware, spyware, and other malicious programs.
  • Backup Important Data: Copy your crucial files to an external drive or cloud storage.
  • Consider a System Reset: For severe cases, or if you cannot remove the threat, a full factory reset of your Windows PC might be necessary. This will erase all data, so ensure you have backups.
  • Inform Law Enforcement: If sensitive data was compromised or you suspect criminal activity, consider reporting it to the cybercrime unit in your local police.

Frequently Asked Questions (FAQ)

Q1: What is Remote Desktop Protocol (RDP)?

A1: RDP is a Microsoft network protocol that allows users to connect to and control a computer over a network connection, seeing the desktop interface as if they were sitting in front of it.

Q2: How can I tell if a login event in Event Viewer is a remote login?

A2: In Event Viewer, look for successful login events (Event ID 4624) with a “Logon Type” of 10 (RemoteInteractive). Also, check the “Source Network Address” for an unfamiliar IP address.

Q3: Can checking my Microsoft account activity tell me about remote access to my PC?

A3: While it won’t directly show RDP access to your local PC, it can show if your Microsoft account itself has been compromised and accessed from unknown locations. This could be a first step for an attacker.

Q4: What should I do if I see an unfamiliar IP address in netstat results?

A4: If you see an unfamiliar IP address with an “ESTABLISHED” connection, note the associated PID. Then, use Task Manager to identify the program linked to that PID. If it’s suspicious, disconnect from the internet and take immediate security actions.

Q5: Is it safe to leave Remote Desktop enabled on my Windows PC?

A5: Leaving Remote Desktop enabled increases your attack surface. If you do not need it, it is safer to disable it. If you need it, make sure you use strong passwords, enable Network Level Authentication (NLA), and consider using a VPN for added security.

More posts