odd RDP behavior

[Jerky]

I have a computer exhibiting some odd behavior and I'm hoping that
someone else might have seen something similar.

Heres the scenario:

Using PcAnywhere from Computer 1 to Computer 2. Then initiate a Remote
desktop session from computer 1 to computer 2. After logging in via
RDP, Computer 2's desktop is viewable/manipulatable from RDP,
PcAnywhere and the Console.

Which seems a bit odd because when I set up the scenario with some lab
computers the result is the Console and PcAnywhere getting locked and
blacked out repectively instead the "console mirroring effect" the
production computer displays.

I have a feeling the user might have done something but I'm not sure
yet. I have an image of the machine that I'm combing for anything odd.

thanks in advance,
jerky

 

[chusome]

I have to ask, Why would you want to do this in the first place?

 

[Jerky]

I don't. It's really for forensic purposes. It was exhibiting odd
unrelated behavior and over the course of things the aforementioned
behavior was discovered. Anything could have been done to the machine
really, I was just hoping someone has seen this and it might be the
result of some script kiddie style toolkit.