Why do I get "There is another user logged onto your computer" when I shut down?

Home » Networking

Summary: 'There is another user logged onto your computer' happens when another user is logged in. That can happen in a couple of ways - one obvious, one not.

Based on your description, I'd personally be concerned that your computer had been infected with some kind of malware allowing remote control.

But before we jump to such an extreme conclusion, let's take a look at just what that message means, and what you might consider doing to determine exactly what's going on.

"There is another user logged onto your computer" can actually mean a couple of different things.

•

If you run remote desktop sharing or terminal services, then someone may, in fact, be logged into a separate session on your computer. This typically requires Windows 2000 or 2003 server for true simultaneous multiple sessions.

Fast user switching is another case where more than one person can be "logged in" to your machine at the same time. Only one logged in user can actually be seen and used, but the other remains logged in in the background. In Windows, if you select "Switch User" when you Log Off, you're not actually logging off; instead, you're simply putting the current user into the background and logging in as a second user. Fast User Switching must be enabled for this feature to work.

In both of the cases above, if you attempt to shut down your machine, you'll get the warning "There is another user logged onto your computer" because there is. Either the remote desktop user, or the account that you switched away from. Naturally shutting down the machine will force them to be logged off as well.

The other common cause of this message is Windows file sharing on a local area network.

If you create a file share on your system such that another machine can copy file from, or possibly to, your machine, that creates a type of remote login. Depending on your network and security settings, among other things, if machine 'B' is connected to a file share on machine 'A', then it is, in a sense "logged in" to machine A. It's a different type of login, but many of the same concepts apply. Perhaps most importantly, much of the same security infrastructure applies.

The net result is that if another machine on your network is accessing files on your machine, then "There is another user logged onto your computer" may result if you attempt to shut down your computer.

•

Now, those are all normal and typically benign reasons for the message. The reason I'm concerned for your case is the high CPU usage or "frozen machine" description you gave.

In a case such as this, the tool I'd reach for first is SysInternals Process Explorer. I'd do two things with it.

First, after running it, I'd click on the CPU column to sort the process list by who's using the processor the most. Here's an example:

Here you can see that the System Idle Process is taking up most of my CPU time - meaning that most of the time my computer has nothing to do. Other processes are listed in order of CPU usage. If you see a process pegged at the top of that list taking most of your processor, then you have something to investigate - what process is it, and why is it being such a hog.

While you're in Process Explorer, there's a quick way to see if more than one user is actually logged in via remote desktop or fast user switching. Click on the Process column heading and the process will be listed in "hierarchy" order - meaning that each process will be listed indented from the process that started it. Normally the list will start something like this:

If you look further down, you'll see an instance of "explorer.exe" to the far left:

"Explorer.exe" is your Windows user interface - the Start button, the task bar and so on.

If you see more than once instance of Explorer.exe on the left, then more than one account is logged in. You can examine the list of processes indented beneath it - those are programs that this user is running. You can also use "Properties" on the process to see what account is being used.

Now all these steps do is get you information. It's quite possible that once you see what's running, you'll say "oh yeah, that", or you'll Google up some information that explains it.

On the other hand, this also might be a very good time to make sure that Norton really is doing what it's supposed to be doing, and is up to date. Alternately, consider running an additional anti-virus or spyware scan, and in any case make sure that your firewall is working properly.

Related:

• Ask Leo! - What's this program running on my machine?

• Ask Leo! - Internet Safety: How do I keep my computer safe on the internet?

Article 11022 | Posted December 26, 2006