guidox / Security
Run **qwinsta** for active sessions, **Get-NetTCPConnection** for a listening 3389, and check the Security log for logon type 10. Then close what you did not start.
**qwinsta** shows console and remote sessions with their state. A second active session while you are at the desk is the first thing to explain.
qwinsta
query user
Get-CimInstance Win32_LogonSession | Where-Object LogonType -in 3,10 | Select-Object LogonId,LogonType,StartTime | Select-Object -First 10
Get-CimInstance Win32_ComputerSystem | Select-Object UserNameRemote Desktop must be explicitly enabled. If it is on and you never turned it on, that is the finding, not a symptom.
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' | Select-Object fDenyTSConnections
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Select-Object DisplayName,Enabled,Profile
Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq 3389 | Select-Object LocalAddress,LocalPort,OwningProcessA successful network logon is **4624** with logon type 10 for RDP and 3 for a share. The source address and the account are in the event data.
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4624} -MaxEvents 20 | ForEach-Object { $x=[xml]$_.ToXml(); [pscustomobject]@{ Time=$_.TimeCreated; Type=($x.Event.EventData.Data | Where-Object Name -eq 'LogonType').'#text'; User=($x.Event.EventData.Data | Where-Object Name -eq 'TargetUserName').'#text'; From=($x.Event.EventData.Data | Where-Object Name -eq 'IpAddress').'#text' } } | Where-Object { $_.Type -in '3','10' } | Select-Object -First 10Quick Assist, TeamViewer and similar tools run as a user process and do not need RDP. Their installation and their running processes are the other half of the picture.
Get-Process | Where-Object { $_.Name -match 'quickassist|teamviewer|anydesk|rustdesk|vnc|screenconnect' } | Select-Object Name,Id,Path,StartTime
Get-Service | Where-Object Name -match 'teamviewer|anydesk|vnc|rustdesk' | Select-Object Name,Status,StartType
Get-ChildItem 'C:\Program Files','C:\Program Files (x86)' -Directory -ErrorAction SilentlyContinue | Where-Object Name -match 'TeamViewer|AnyDesk|RustDesk|VNC' | Select-Object FullNameTurn RDP off when it is not needed, remove the firewall rule, and stop the remote tool's service. A password change ends any session that is already authenticated with the old one.
Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 1 -Type DWord
Disable-NetFirewallRule -DisplayGroup 'Remote Desktop'
Get-Service | Where-Object Name -match 'teamviewer|anydesk|rustdesk' | Stop-Service -Force
Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq 3389The check is the same as the first step. No 3389 listener, no remote process, and one console session is the state you want.
Get-NetTCPConnection -State Listen | Where-Object LocalPort -in 3389,5900,5938 | Select-Object LocalPort,OwningProcess
qwinsta
Get-Process -IncludeUserName | Where-Object UserName -notmatch 'SYSTEM|NETWORK|LOCAL' | Select-Object Name,Id,UserName | Select-Object -First 10Check the logon events for its start time and source address. A disconnected session still counts as active until the timeout.
It may be a console session over a KVM or a virtualization console. Match the session ID to the process list.
Look at the remote tool's own logs and at the installed programs list by date. A tool installed yesterday is easy to miss.
A rule can exist without a service. The listener check is the reliable indicator, not the firewall rule.
No. It is a local session with a cloud identity, not a remote session on the machine.
Only with a saved credential or a remote tool the user approved. That is why the installed-programs list matters.
If you do not use them, yes. If you do, require a password and a prompt on every connection.
Re-enable RDP with Set-ItemProperty fDenyTSConnections = 0 and Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' if you turned it off but need it.
Free · no account needed · tracks your progress