Link to home
Start Free TrialLog in
Avatar of Enhance Technology
Enhance TechnologyFlag for India

asked on

How to find who used my machine via Remote Desktop Cntn in win 7

Hello,
I need to know , how to find the person's IP address who used my machine via remote desktop connection in windows 7. I am annoyed by this repeat access and i couldn't find who is making use of my system. When they access it the person closes all the window's that are active. I haven't done anything to anyone like this and its disturbing me a lot. Kindly let me know if there are any ways to find it out.
Avatar of Lee W, MVP
Lee W, MVP
Flag of United States of America image

There is no way to find out UNLESS you already have 3rd party logging software installed to tell you.  Windows doesn't track what IP accesses it by default.

If they are closing your Windows, then they have your password - CHANGE YOUR PASSWORD.

If they don't have your password then they are not connecting via RDP but rather through some third party remote control software - in which case, disable or uninstall the third party software or check the third party software logs.

When you connect via RDP it doesn't take over whoever is logged in - it "switches users" and leaves everything you have as is.  If it's changing then someone else has your password or they are not connecting with RDP.
ASKER CERTIFIED SOLUTION
Avatar of Adam Brown
Adam Brown
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Hello There
Hello There

If you are in a domain, admin may sometimes do some work on your PC. You won't be able to do anything about it.

If you are not in a domain:
1. In case you are logged off when someone connects to you (he/she is using RDP), change your password.
1. In case that you can see what actions someone does, uninstall all third party software related to remote access like TeamViewer, VNC, LogMeIn etc.
You should normally find a logon event in security log. see attached
RDP.jpg
Avatar of Enhance Technology

ASKER

Is there any kind of way to checking IP wise log, all systems having same user name & password and we couldn't change password.
If everybody uses the same credentials, you cannot find the person (by the name) who is causing this.

BTW Are you in a domain? Have you tried to discuss your problem with your administrator?

How do this person log on to your PC (RDP or third party software)?

Do you have rights to change any settings on PC?