Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A regular user logs out leaving some applications running. Then an administrator enters the system, and is able to terminate the former's processes.

But could he use said applications including their GUIs?

share|improve this question
Logging out closes all programs. Did you mean "locks screen/workstation"? – grawity Aug 28 '11 at 16:55
Logging off doesn't kill a given user's processes... – vemv Aug 28 '11 at 18:02
On Windows NT it does, at least with all versions I've used. – grawity Aug 28 '11 at 19:28
You're entirely right. In addition (and at least by default), even by fast user switching, an admin won't be able to see other the users processes as much as they're actually running. – vemv Aug 29 '11 at 17:36
up vote 4 down vote accepted

Given sufficient privileges (specifically SeTcbPrivilege which only SYSTEM account has), it is possible to connect to any session without a password.

If the system supports multiple sessions ("Fast user switching" and the like), the administrator can log in to their own account, then run psexec -si tscon OldSessionID and access the other user's session without having to unlock it.

(I have tested this on XP Pro, but I'm not sure if it works on Vista/7 which handle sessions slightly differently.)

To leave the user's session, just lock the screen again by using Win+L, or run tsdiscon.

share|improve this answer
Sounds awesome, will try it and leave feedback. Thanks – vemv Aug 28 '11 at 18:03
Jesus, it works! Thanks so much. Looks like that sysinternals site will be a close friend of mine from now on. – vemv Aug 29 '11 at 17:24
For future reference: The actual work is done by tscon, while the only thing psexec does is raise its privileges. Other useful commands are shadow (remotely control an active session), qwinsta, rwinsta/logoff, msg... – grawity Aug 29 '11 at 17:29

The simple answer is no, admins can see the processes being run, but not the applications themselves.

However, an admin could change your password and log in as you. Then they could see what you were doing. This of course would become apparent when you tried to log in and your password was changed.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .