Official forum for Utopia Community
You are not logged in.
Windows 10 Version 1803 (OS Build 17134.765)
I recently started a new job. Over the past few weeks, a former employee whose presence we do not desire has been remotely accessing their old desktop in the office. The computer has an antivirus and has been scanned with both Malwarebytes and Super Anti Spyware, so I am posting this here and not in the malware-related forums. This person appears to be using legitimate software to access the PC.
Here's how it goes. Someone will be using the computer, when all of a sudden the cursor starts moving around the screen and clicking on things by itself. This happens intermittently, probably once every few days. I took a look at the computer and noticed that remote access was allowed, so I disabled it. It has had no effect. Just this morning, it happened again, so I disconnected the internet cable from the computer. For a brief moment, a Windows pop-up appeared in the lower right corner which said something to the effect of "(name) has disconnected". Unfortunately, the PC was still connected to our 5G network so the intrusion continued. Bear in mind that just this one PC is being remotely accessed as far as I know, and not any other computers on the network.
Clearly, the former employee has some means by which they are accessing the PC legitimately. I just can't figure out how. I took a look through the program list, and didn't see anything that was obviously for remote use (although I'm not the most tech-savvy person, so maybe I just missed something). Having disabled the remote access function on Windows, how is this guy still getting in?
Offline
Without knowing anything about the configuration it is difficult to give any clear advice.
If the user was the IT person it makes it a little more difficult as they would know local admin account information.
The software they are using is a remote desktop software that doesn't require permission to access, this could be Dameware, VNC, TeamViewer, or a host of other products.
Reloading the machine is probably the best answer. A machine should be reloaded prior to a new user being assigned the machine, to prevent issues such as this one.
Offline
Is there a specific reason your IT folks cannot either reimage the computer, if you have IT folks and they do this routinely, and most mid-sized to large organizations do, or Doing a Completely Clean Install of Windows 10, then reloading the software you use?
Either method will be the easiest and most assured road to success to blocking whoever happens to have access at the moment.
There are a wide number of variables that could take quite a while to even attempt to dig through, and even then the result you seek will not be guaranteed. A reimage/clean reinstall virtually guarantees it.
Offline
You didn't say if this was Home, Pro or Enterprise. RDP does not work on Home, but of course other third party programs do as suggested above by others. If using one of the latter two OS's, look at this tutorial to setup RDP, but do the opposite and Un-check the box for remote access if it is indeed checked. Unless other admins are using RDP, then I suggest you leave things alone.
How to Set Up and Use Remote Desktop for Windows 10 (https://www.groovypost.com/howto/setup- … indows-10/)
Offline