The mouse is moving on its own, and you’re not touching it.
A pointer that drifts, a click that lands by itself, a window that opens while you watch. Most of the time it is the mouse, a laptop touchpad, or a wireless receiver picking up something it shouldn’t, and that is the first thing to rule out.
A hardware test never covers a second person on the other end of a connection. The two look alike for the first few seconds, and they call for opposite responses: replace a part, or take the computer off the network. This page separates them by what the pointer does, then covers where a remote session shows up and the one decision that follows.
Read what the pointer is doing
The pattern says more than the fact that it moves.
- Points toward a part: a slow drift in one direction while your hand is off the desk, a jitter, a jump to a corner, or movement that only happens with one particular mouse.
- Points toward a person: a straight, deliberate path to one button or menu. Windows opening, text appearing, files moving, or a pointer that keeps working while every mouse is unplugged.
- Worth noting either way: whether it started right after a phone call, an email attachment, or someone asking you to open something.
A test that rules out the hardware
A pointer that still moves with the mouse unplugged rules out that mouse, not the others on the list. If it still moves with all of them removed, go to the next section.
- Unplug a wired mouse. Switch off a wireless mouse and pull its USB receiver.
- On a laptop, turn the touchpad off in Settings, Bluetooth & devices, Touchpad.
- Unplug anything else that can move a pointer: a game controller, a drawing tablet, a second receiver.
- Take your hands off the desk and watch the screen for a full minute.
- If it stops, plug the devices back in one at a time. The one that brings the movement back is the part.
Look for a second person on the computer
Remote-support programs that are not part of Windows are covered on the page about a remote-access program you did not install. They can run without appearing in the installed list.
- Open Command Prompt and type query user. Windows lists each signed-in user with a session ID, a state (active or disconnected), idle time, and the sign-in date and time. The row marked with a > is yours. A second row you can’t match to a person is the one to write down.
- Open Start, Settings, System, Remote Desktop. Microsoft’s guidance is that Remote Desktop is only needed if you reach the PC from elsewhere; by default only administrators and the users you add can connect. If it is switched on and nobody here turned it on, record that. Windows Home editions can’t host Remote Desktop connections.
- Ask who has used Quick Assist. A session needs the person at the computer to enter a 6-digit code and select Allow, and control needs a second Allow. If anyone read a code to a caller recently, that is the answer to start from.
- In Event Viewer, Windows Logs, Security, look at event 4624 around the time the pointer moved. Logon type 2 is someone at the keyboard, 7 is an unlock, and 10 is a remote logon through Remote Desktop. The event also records where the logon came from.
The decision: disconnect and record, or keep watching
Disconnect and record when the movement is purposeful, when the check above finds a session or a setting nobody here can explain, or when someone on the phone had you open something. Unplug the network cable and switch Wi-Fi off. Leave the power on: both the FTC and CISA advise taking an affected computer off the network rather than shutting it down, because a shutdown erases what is held in memory.
Then photograph the screen and write down the time, what moved, and what was open. Don’t sign in to anything else on that computer. Passwords you typed on it while it was moving are the ones to change later, from a different computer. The FTC’s advice to anyone who gave a caller access is to change passwords right away.
Keep watching when the hardware test stopped it, or when the person who runs your IT is on the way and asks you to leave it connected to see what happens. That is their call to make. A session left open to watch it also leaves the other person connected.
What these checks can and can’t show
They show what is on this computer now and what Windows recorded. A session that ended leaves only log entries, and a log with no entry for that time is not a clear answer. A remote tool that leaves no trace in the places above won’t appear in any of them. A clean result covers what was examined on the date it was examined.
If a caller who claimed to be tech support started this, the FTC takes reports at ReportFraud.ftc.gov.
What we check with you
The signed-in sessions, the remote-access settings, the programs that start with Windows, and the logon records for the hours around the movement. A person writes up which of these showed a second person at the machine and which didn’t, with dates.
A moving pointer is either a part or a person, and everything above is how to find out which before you decide what to do with the computer.
Related
Sources
- Microsoft Support: Solve PC problems remotely using Quick Assist
- Microsoft Learn: Enable Remote Desktop on your PC
- Microsoft Learn: query user
- Microsoft Learn: 4624(S) An account was successfully logged on
- FTC Consumer Advice: How to Spot, Avoid, and Report Tech Support Scams
- FTC: Data Breach Response, A Guide for Business
- CISA: #StopRansomware Guide
Get answers about the computer you’re worried about.
The Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Rather talk to a person?
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.