- Ask for the check straight away and keep the player in voice until it is done.
- Write down the reason before the check, and the decision after it.
- Read hard evidence, signs and what the report could not see separately - and check the dates.
A screenshare is a check of a player's computer when staff have a reason to believe they are cheating. Done well, it is quick, fair and gives you evidence you can stand behind. Done badly, it turns into a forty-minute argument over remote desktop. This is the version that works.
When to ask for a check
A check is a serious request, so it needs a reason you can write down. Typical ones:
- Reports from several players about the same person, especially with clips.
- Something your own staff saw: reactions no human makes, aim that follows players through walls, movement a normal client does not allow.
- Alerts from your server's own anti-cheat or logs that point to one player.
- A ban appeal where the player says they are clean and offers to prove it.
Write the reason down before you contact the player. It keeps your staff consistent, and it is the first thing you will need if the decision is challenged later.
Before you send anything
Ask straight away. Most cheaters start cleaning up the moment they sense trouble. Ask for the check while the player is still in the game or in voice, and keep them there until it is done.
Explain what will happen. One file, an administrator prompt from Windows, a consent screen that lists what is collected, and a few minutes of waiting. A player who knows what to expect is far less likely to refuse.
Agree in advance what a refusal means. Most servers treat refusing, or leaving during a check, the same as a positive result. Whatever your rule is, put it in your server rules so nobody has to decide it on the spot.
Tell the player that Windows may show a SmartScreen warning for the file. Saying it first stops it from turning into an excuse.
The check, step by step
- Create the check.Give it the player's name, so everyone on staff knows whose check it is.
- Send the link.In a direct message or a ticket. The download is built for that one check and works for nobody else.
- Stay with the player.Keep them in voice while they download, approve the administrator prompt and accept the consent screen.
- Wait for the report.When the scan finishes, the report arrives on its own and the program closes. Nothing stays on the player's computer.
- Read before you react.Go through the result calmly - with a second staff member if it is a hard case.
Reading the result
A useful report does not just say clean or cheating. It shows what was found and where it came from, so you can judge it yourself. Look at three things, in this order:
- Hard evidence. Traces of known cheat software: a cheat that ran, a cheat file on disk, a download from a cheat site, a cheat loaded into the game. One solid trace usually decides the case.
- Signs to weigh. Things that are suspicious on their own but can have an innocent explanation - macro software, a hacking tool the antivirus caught, an unusual driver. These need context.
- What the report could not see. A brand-new Windows account, a fresh Windows install, cleared history. An empty report from a machine that was wiped an hour ago is not the same as a clean one.
Check the dates as well. A trace from two years ago and a trace from this morning tell very different stories.
Making the decision
Decide on the evidence, not on the colour of the verdict. Hard evidence of a cheat that ran recently usually means a ban. If there are only signs, talk to the player about the specific item and decide together with a second staff member. Write down what you decided and why, next to the check, so the next admin does not start from zero when an appeal arrives.
A file named after a cheat is not always a cheat - a screenshot, a video or an unrelated program can share the name. Look at what the file is, and whether it actually ran.
Staff checklist
- Reason for the check written down
- Player asked immediately and kept in voice
- Player told what the program does and how long it takes
- The rule for refusing or leaving is in your server rules
- Report read in full: hard evidence, signs, what it could not see, dates
- Hard cases looked at by a second staff member
- Decision and reason recorded next to the check
Common mistakes
- Waiting. Every minute between suspicion and check is a minute to delete things.
- Remote desktop instead of a check. It shows only what is on screen now, depends on who is clicking and takes far longer. Here is the comparison.
- Deciding on one line. Read the whole report, including what it could not see.
- No record. Without a written reason and decision, every appeal becomes your word against theirs.