PanicStation.org
UK USA
us Technology & digital loss

What to do if…
you receive a notification that screen sharing or remote management was enabled without your consent

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Disconnect the device from the internet as soon as you can safely do so, then secure your main email and device accounts from a different trusted device. Do not approve any new remote-access prompt while you are sorting this out.

Do not do these things

  • Don’t approve prompts to “Allow”, “Trust”, “Enable”, “Share Screen”, or “Give Control” if you did not start the request.
  • Don’t call numbers in pop-ups, alerts, emails, texts, or search ads claiming to be urgent support.
  • Don’t let anyone talk you into installing AnyDesk, TeamViewer, Quick Assist, Remote Desktop, Screen Sharing, or another remote-control tool unless you reached that support channel yourself.
  • Don’t log into banking, payroll, tax, email, cloud storage, or password manager accounts on the affected device until you have contained the situation.
  • Don’t wipe the device immediately if you may need evidence for work, school, insurance, a bank, or a report; capture the basic alert details first if you can.
  • Don’t assume it is harmless if settings are locked, a new administrator account appears, or the device says it is managed and you did not expect that.

What to do now

  1. Cut off remote access.
    Turn off Wi-Fi, unplug Ethernet, and turn off any hotspot or cellular tethering the device is using. If you can, also turn on Airplane Mode and turn off Bluetooth. If several devices on your home network look affected, take the router or modem offline while you stabilize.

  2. Capture the alert before changing more settings.
    Take a photo or screenshot showing the notification, time, date, device name, app name, account name, and any wording such as “Screen Sharing”, “Remote Management”, “Remote Desktop”, “Remote Assistance”, “Quick Assist”, “MDM”, or “device is managed”.

  3. Check whether the device is supposed to be managed.
    If this is a work or school device, or if you sign in with a work or school account, contact IT through a known internal route such as your staff portal, official helpdesk number, or known company chat. Remote management can be legitimate on managed devices, but IT should confirm whether this specific change was authorized.

  4. Turn off visible remote-control features while keeping the device offline where possible.
    Check the device settings for screen sharing, remote management, remote desktop, remote assistance, Quick Assist permissions, accessibility control, and “allow remote control” options. Turn off anything you did not enable. If a setting is locked, greyed out, or controlled by an unknown profile, take a photo and move to the account-security steps.

  5. Look for new administrators and management profiles.
    Review user accounts, administrator accounts, login items, device management, profiles, MDM, and work or school management settings. If you see a name you do not recognize, photograph it before removing it. If it is a work or school device, do not remove management profiles until IT tells you to.

  6. Secure the accounts that could control the device, using a separate trusted device.
    Start with your email account, then Apple Account, Microsoft account, Google account, and any work or school sign-in. Change passwords to unique strong passwords, turn on multifactor authentication, sign out of other sessions, and remove unknown devices or recovery methods.

  7. Check for remote-control apps.
    Look for remote-access or support apps you did not install or did not expect, such as AnyDesk, TeamViewer, Chrome Remote Desktop, Quick Assist activity, Remote Desktop, VNC tools, screen-sharing tools, or unknown management agents. Photograph suspicious entries before uninstalling them.

  8. Run a security check without rushing to reconnect.
    Use built-in security tools or trusted security software already on the device if available. If the device needs internet access to update or scan and you still do not trust it, use employer IT, school IT, the device maker’s official support, or a reputable local technician before reconnecting.

  9. Consider a clean reset if you cannot regain trust.
    If remote access keeps returning, administrator settings are unknown, management profiles are suspicious, or sensitive accounts were used on the device, a full reset or reinstall may be the safest way to regain control. Restore only needed files from a backup you trust. Coordinate with IT first for any work or school device.

  10. Report if there was fraud, extortion, data loss, or money loss.
    If this appears to be cybercrime, file a complaint with the FBI’s Internet Crime Complaint Center. If it involved a tech support scam, report it to the FTC. If your identity information was exposed, use IdentityTheft.gov for recovery steps. If you are in immediate danger or an active crime is happening now, call 911.

What can wait

  • You do not need to identify the exact malware, attacker, or technical method right now.
  • You do not need to decide today whether to replace the device.
  • You do not need to answer threatening messages or argue with anyone claiming to be support.
  • You do not need to notify every contact immediately; secure your accounts and any work or school channel first.
  • You do not need to erase the device before you have captured the basic alert details.

Important reassurance

A remote-management or screen-sharing alert can feel very invasive. The most useful first moves are simple: get the device offline, save the basic evidence, and secure the accounts that could let someone regain access.

Scope note

These are first steps for stabilizing the situation and reducing harm. Later decisions may need help from work or school IT, a device manufacturer, a bank, an identity-theft recovery service, law enforcement, or a qualified security professional.

Important note

This is general information, not legal, medical, financial, therapeutic, cybersecurity, forensic, or professional advice. Device menus and workplace rules vary. Use official support channels and known contact routes when you need help with a specific device or account.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us