Could another user be connected to the computer?¶

Yes. Another user may be connected through remote desktop, a shared session, administrative tools, virtual infrastructure or network services.

Why this matters¶

The dangerous assumption is that the visible desktop represents a single user working alone. Several users or processes may be active at the same time.

What to record and do¶

Record any visible connected-user list, session banner, chat, remote desktop window, administrator console or account-switching screen.

Capture usernames, session names, hostnames, addresses and timestamps where visible.

Do not switch users, log anyone out or send messages through the system merely to identify them.

Another session may contain unsaved data, active processes or evidence held only while connected.

Disconnecting one user may also trigger alerts, terminate access or change central logs.

Where the computer is part of a server, business domain or virtual environment, seek system-administration and forensic support.

Do not assume that a username identifies the real person using the session. Shared credentials, compromised accounts and automated services remain possible.

If another user appears to be actively changing evidence or causing harm, containment may be necessary. Record the activity first where this can be done without unacceptable delay.

Document every session change, logout or disconnection.

Another user may also be connected through a background service without a visible desktop. Record any evidence of multiple logons, user switching, shared folders or central administration, but do not navigate deeper merely to confirm suspicion.

Operational takeaway¶

Record all visible user and session activity without switching or terminating access, and keep account identity separate from the person actually controlling the session.