How can I find out which processes on my computer are accessing the microphone?

Question

After reading this interesting Lifehacker post and reading the comments on the page, one person was wondering if it would be possible to use the Physical Device Object Names of other hardware such as the microphone to find out the names of processes using that device.

I tried the same approach, but so far it only seems to work for the webcam. Is there any other way I could get this to work in Process Explorer?

---

UPDATE:

The Lifehacker post was about finding out which Windows process is currently using your webcam. This is how they went about doing it:

1. Start Device Manager
   (WIN+R → "devmgmt.msc" → OK)
2. Find your webcam among the list of devices (check under Imaging Devices)
3. Open the properties window of the device and switch to the Details tab
   (Right click → Properties → Details)
4. In the dropdown menu, select Physical Device Object Name and copy the string
   (Right click → Copy)
5. Download Process Explorer
6. Make sure you have opened Process Explorer in Administrator Mode
   (File → Show Details for All Processes)
7. Hit CTRL+F and enter the string you copied earlier
   (it should be something like \Device\000000XX)
8. Hit the Search button and you should see a list of processes using the webcam
   (if there are any)
   

Solution 1

Answering my own question because I just discovered this today. There may be a better solution available for this problem by now but this might be the simplest or most straightforward one, at least if you're running Windows 10.

Whenever there's an app using the microphone, you can see this icon in the taskbar.

Click on it and it'll take you to the Microphone section under App Permissions in the Privacy page in the Settings app.

Scroll down to the Allow desktop apps to access your microphone section and sort by Last used

This screen shows when the microphone was last used by what app sorted by date and for apps currently using the microphone, the apps are listed at the top with the caption, Currently in use.

Solution 2

I can indeed confirm this works with the same thing, altho device manager / Audio devices doesn't work the same for me.

To clarify:

1. Right click your Volume icon on the lower right hand on the task bar.
2. Click 'Recording Devices'
3. Right click your current / Default Device and go to 'Properties'.
4. Under where it says Controller Information click 'Properties' and under the 'Details' tab when it pops up, under Property, go to Physical Device Object Name.
5. Right-click and copy the Device path. After this you can find it in Process Explorer or wherever necessary.

Notes: For me it's not the device name (Headset Microphone) but rather Bluetooth Hands-free Audio. Huh. It may be different depending on your hardware. I was able to find all processes using my mic, including the audiodg.exe (Where you open it up to test if your mic is working.)

Good luck guys!

Comments

[Parth Parikh]

You can search for audioses.dll which is used for most of the audio sessions.

[Vinayak]

@ParthParikh I tried searching for audioses.dll, and it brings up a lot of processes. Even if a process isn't recording any sound it still shows up (e.g. Sound Recorder, Skype, etc.) I need a way to only show the processes that are currently using the microphone.

[Daniel Heusburgh]

i.stack.imgur.com/tvH7p.png

[Vinayak]

Are you sure that it works? Your screenshot doesn't look convincing. I've tried the exact same thing and it won't work for me. I'd be convinced if by this method you can find processes like skype.exe or audacity.exe. If you could test further and let me know what you get, that'd be helpful. Thanks.

[sambul35]

In my case search results show many svchost.exe lines, which is still not very informative, since each svchost process actually hosts a different running program. What are these programs, and which of them is a recording spy is still not clear. So the next step is to open each listed svchost PID, and check what program it hosts. However, such program can mask under the name of any legit Windows or 3rd party program component, so more research will still be needed.

[Admin]

The issue is when that process is svchost.exe, which run a lot of different services. How do you find the service using the mic?