Helping people with computers... one answer at a time.

'There is another user logged onto your computer' happens when another user is logged in. That can happen in a couple of ways - one obvious, one not.

I turned on my computer and came back after 30 minutes or so to let Norton do its scans and so forth. When I tried to start working my computer was nearly frozen, so I tried to shut it down. I got a message that said "There is another user logged onto your computer if you terminate now they may lose there work" - so I quickly powered off but What's going on? this is a new problem and I have never accessed nor anyone else from elsewhere.

Based on your description, I'd personally be concerned that your computer had been infected with some kind of malware allowing remote control.

But before we jump to such an extreme conclusion, let's take a look at just what that message means, and what you might consider doing to determine exactly what's going on.

"There is another user logged onto your computer" can actually mean a couple of different things.

If you run remote desktop sharing or terminal services, then someone may, in fact, be logged into a separate session on your computer. This typically requires Windows 2000 or 2003 server for true simultaneous multiple sessions.

Fast user switching is another case where more than one person can be "logged in" to your machine at the same time. Only one logged in user can actually be seen and used, but the other remains logged in in the background. In Windows, if you select "Switch User" when you Log Off, you're not actually logging off; instead, you're simply putting the current user into the background and logging in as a second user. Fast User Switching must be enabled for this feature to work.

In both of the cases above, if you attempt to shut down your machine, you'll get the warning "There is another user logged onto your computer" because there is. Either the remote desktop user, or the account that you switched away from. Naturally shutting down the machine will force them to be logged off as well.

The other common cause of this message is Windows file sharing on a local area network.

If you create a file share on your system such that another machine can copy file from, or possibly to, your machine, that creates a type of remote login. Depending on your network and security settings, among other things, if machine 'B' is connected to a file share on machine 'A', then it is, in a sense "logged in" to machine A. It's a different type of login, but many of the same concepts apply. Perhaps most importantly, much of the same security infrastructure applies.

The net result is that if another machine on your network is accessing files on your machine, then "There is another user logged onto your computer" may result if you attempt to shut down your computer.

Now, those are all normal and typically benign reasons for the message. The reason I'm concerned for your case is the high CPU usage or "frozen machine" description you gave.

In a case such as this, the tool I'd reach for first is SysInternals Process Explorer. I'd do two things with it.

First, after running it, I'd click on the CPU column to sort the process list by who's using the processor the most. Here's an example:

Process Explorer sorted by CPU Usage

Here you can see that the System Idle Process is taking up most of my CPU time - meaning that most of the time my computer has nothing to do. Other processes are listed in order of CPU usage. If you see a process pegged at the top of that list taking most of your processor, then you have something to investigate - what process is it, and why is it being such a hog.

"...consider running an additional anti-virus or spyware scan, and in any case make sure that your firewall is working properly."

While you're in Process Explorer, there's a quick way to see if more than one user is actually logged in via remote desktop or fast user switching. Click on the Process column heading and the process will be listed in "hierarchy" order - meaning that each process will be listed indented from the process that started it. Normally the list will start something like this:

Process Explorer top of the hierarchy list

If you look further down, you'll see an instance of "explorer.exe" to the far left:

Process Explorer showing explorer.exe

"Explorer.exe" is your Windows user interface - the Start button, the task bar and so on.

If you see more than once instance of Explorer.exe on the left, then more than one account is logged in. You can examine the list of processes indented beneath it - those are programs that this user is running. You can also use "Properties" on the process to see what account is being used.

Now all these steps do is get you information. It's quite possible that once you see what's running, you'll say "oh yeah, that", or you'll Google up some information that explains it.

On the other hand, this also might be a very good time to make sure that Norton really is doing what it's supposed to be doing, and is up to date. Alternately, consider running an additional anti-virus or spyware scan, and in any case make sure that your firewall is working properly.

Article C2880 - December 26, 2006 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

20 Comments
Matt Hickman
December 29, 2006 10:21 PM

Another way to tell if there is someone else logged on to your computer is with task manager.

In XP Home, there is a "users" tab that will tell you if there is someone else on using the fast user switching function.

Also, for all XP versions, under the processes tab, you can do a "view"=>"select columns" and check the "user name" column to display. Besides your name, you normally might see "system", "local service" and "network service". Also, certain services may run under alternate User Names. But you should be able to tell if there are any user names that are suspect.

David
December 30, 2006 1:46 PM

I have 5 user accounts on this machine and even when they are all logged off, except for me, I still get that message shutting down. I just figured it's a bug...I know there's no remote sharing of any kind. It happens everytime I shut down or restart. I don't worry about it.

david
January 15, 2007 8:00 PM

lmao...I spoke too soon.....if I "log off" my account, I don't get that get that message. You ever feel stupid after somethin you said?? lol

Celine
January 27, 2007 2:14 PM

No one believes that it is possible for someone else to be loged on my computer. But then, where are all the music files coming from? Help!

brian
February 9, 2007 7:00 AM

if you have magic song files on your system you have been hacked. get a firewall and a good do an online scan from pest partol or panda.

Janet Hopper
February 9, 2007 11:30 AM

I would like to put a friend of mine on MSN and he has given me permission to so hopefully I can do it and I don't see why not. Please get back to me as soon as possible as it is really important that I get this account for him.

Amgoe
May 17, 2007 6:15 AM

what is the ASP.net Isee in my users list? Can I delete it?

Glynid Navarrete
November 19, 2007 11:00 AM

i've read the article above and it has been very helpful...i wanna ask one thing though, which is unrelated to this article but i'm hoping to find an answer here. i'm just wondering why spywares/malwares/trojan still get into a computer even if there is an anti-virus software already installed.

i hope you can solve my confusion on this one

tnx!

M
March 8, 2009 7:05 AM

Hi! I have also had the message someone is logged onto your computer bla bla..... I suspect that someone is in my computer but i have ran the recommended checks and found nothing so far.Any more suggestions anyone?
Im gonna sound paranoid here but is it also true that your phone can be tapped using stealth software?

rox
March 10, 2009 1:15 AM

Download a utility called as psloggedon and you can figure out who has logged on to your system. you will get the software from microsoft technet.

Sylvia
June 23, 2009 10:53 PM

How can I tell if someone has tried to use my computer? I am the only administrator, there isn't any guest user either. Also, fi someone has tried to shut down my computer, how can i tell?

Prasad
August 27, 2009 11:47 PM

Sir,
In windows XP How to disable the message which pops up after clicking on turn off your computer (I have a remote desktop enabled on other computer.
Please reply.
Thank You.

Maggie
September 27, 2009 5:16 PM

I too have this problem on both Vista on my HP Desktop and my XP in my Dell notebook. On the HP Desktop it will not let me install a program called BalanceLog. The InstallShield Wizard says, "There are multiple users logged into your machine at the same time (fast-user switching). While BalanceLog works with this future, we requier all other Users be logged off when installing. Please log all users off and reboot your computer before running this installation." My computer is not set up for other users to logon.

Carrie
January 28, 2010 9:08 AM

Maggie - did you figure out how to install BalanceLog? I am having the same problem installing it on my computer running Windows 7. Would love advice.

Thanks.

foxyone
June 11, 2011 11:43 PM

when m computer says you are being logged off because you have another user on your computer what does it mean and how can i find out names of people who are on my computer

mobby
September 15, 2011 1:11 AM

How can I tell if someone has tried to use my computer? winxp

Quite often you cannot. It's difficult to come up with a set of rules of things to look for because many of the signs of tresspass can also be signs of normal use.
Leo
15-Sep-2011

Andrew
October 21, 2011 1:27 AM

I have found the Sysinternal processexplorer very help full Thank You Leo.

I am trying to prove who gets access to my computer can I trace back to the IP of the bandit who is getting into my computer . I know this because when closing down I am advised on the screen other users are logged in

Terry
September 11, 2012 10:35 PM

No response required, just for your edification. I am in China and the government here has put something on my computer. It is always crashing and running out of memory. Usually comes up with the "other users" message when I reboot. Love to know how to block the bastards. They go home at 5 pm and suddenly everything works! Lovely country.

connie
September 12, 2012 7:32 AM

@Terry,
Try Ubuntu, they might not be able to get into that. You can try it out easily without even changing your operating system by booting your computer from a live CD. Here's more:
What's a live CD and why would I want one?

Terry
September 13, 2012 8:50 PM

Thanks Connie, I will give it a shot.

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.