Still logged in to Steam after signing in to a different Windows user account

[lonestar]

I just logged in to Steam using my own Windows user account and then I switched to a different Windows user account, which is on the same device.

As it turns out, I was still logged in to Steam, even though I switched to a different Windows user account—which was not mine. When I opened Steam from that other Windows account, I was still logged in, I was still able to play the games I bought, and it had full access to my account.


Why does Steam keep me logged in even after I switched Windows user accounts?
Is there a way for Steam to log me out when switching to another user account?


Note:
Even if I didn't save my credentials and password, if I logged in to my Windows user account and then I switched to a different one, I was still logged in to Steam.

Steam does not switch to a different user when switching to a different Windows user account.

[Bumbefly (we/All)]

Windows has 2 ways of switching accounts. At first you don't mention which way you used to switch, that is important for this particular forum message. You did mention in the Note.

1. Sign Off closes everything opened at the previously used account. That should include a Steam login.
   
2. Other User. This will not close anything opened at the previously used account. Thus most all of your log-ins will remain, not only for Steam.

[lonestar]

Signed off my regular steam account = Still logged in to Steam after logging in as another user.
Switched to another user while my Windows acocunt was still logged in = Still logged in to Steam.

Regardless of whatever I do (e.g. shutdown, restart, hibernate, etc.), as long as I log in to Steam, I'm not automatically logged out, even after switching to a different user (which is not mine).


What scares me most is that if I just leave my computer on and my other family member(s) log me out, they still have access to my Steam account. They can see the games I'm playing, the messages I've sent, my privacy options, they have full control of everything.

[Bumbefly (we/All)]

That is a serious matter indeed. Have you tried un-/re-installing Steam? Note, you'll want to save the folders SteamApps (Games) and Backups (if you made back-ups from your games). In your case i would not keep the UserData folder in Steam.

Normally you'ld want to keep Steam UserData for screenshots and game-saves. The Steam Support FAQs don't mention to back-up your Back-up and UserData folders.

[Bumbefly (we/All)]

Auch, you have family issues too don't you? For me it's 40 years to late and mother (the patrionarch in the family) still chooses to live in denial. I hope you can resolve them, in my eyes that's more important then a computer-issue they will not abuse if you got a good relation.

[MaddDoktor [Linux]]

Do you have Steam set to start automatically and/or remember your password. Maybe it is not staying logged in, but starts and logs in automatically when logging into Windows as "any" user, using whatever saved Steam username/password. So you might try having Steam NOT start automatically and NOT save your password if that is a concern.

I primarily run Linux at home because it boots quicker and is safer, even without any anti-virus, and does not download updates and reboot in the middle of a game.

[Tommy Shelby]

Whath?

[bloop]

I've noticed this same problem, very irritating and apperently no way to fix???

Any ideas? I've tried everything in this thread and more... I think it may have to do with files in the public user data section of the C:\Users\ maybe... I don't Know. I'm using Windows 10, what about you guys?

[murshade]

This is still an issue in 2022, but when I uninstalled and reinstalled, it seemed to behave, but then a new flaw appeared. On the shared computer, if you locked screen and someone else logged in under a different windows account, and started steam, it would close your game and log you out of steam with no warning to anyone. Windows accounts are supposed to keep user data separate, not share them in system file locations. (likely a security design flaw.)

[RiO]

Originally posted by Bumbefly Sony Test םו:

Windows has 2 ways of switching accounts. At first you don't mention which way you used to switch, that is important for this particular forum message. You did mention in the Note.

1. Sign Off closes everything opened at the previously used account. That should include a Steam login.
   
2. Other User. This will not close anything opened at the previously used account. Thus most all of your log-ins will remain, not only for Steam.

Old post I'm replying to, but for the record:

Whether you quick-switch or sign off and sign on for a different user should literally not matter one single iota.

Quick-switching means two users should be concurrently running their own separate instances of programs. Operative word: SEPARATE.

Normally, for any sanely written Windows program this will Just Work (TM) because generated program data is stored in the AppData; Documents; etc. folders associated with the user profile running the program.

But Steam was engineered according to outdated anti-patterns from the 90s and just dumps all data, including user-specific data and logins, into the installation folder of the program. And then shares it all across all and any OS users.

Originally posted by murshade:

This is still an issue in 2022, but when I uninstalled and reinstalled, it seemed to behave, but then a new flaw appeared. On the shared computer, if you locked screen and someone else logged in under a different windows account, and started steam, it would close your game and log you out of steam with no warning to anyone.

Yes; this is Valve's kludge to prevent multiple users from concurrently using the same Steam account. It prevents e.g. multiple users launching Steam and logging in on the same account, and then e.g. all of them starting Steam Link remote play titles concurrently without separate users having to purchase separate titles.
It's a deterrent for unsanctioned game-sharing.

Originally posted by murshade:

Windows accounts are supposed to keep user data separate, not share them in system file locations. (likely a security design flaw.)

Yes; and Windows accounts do in fact do that correctly.
it's just that Valve isn't using the correct approach to store that data. See above,

In fact, the Steam Service running under the SYSTEM user actively subverts the entire folder and file security permissions model that Windows has going on, by giving all users that belong to the normal users group full write permissions to any part of the file system below Steam's install folder and any part of the Registry below certain registry keys.
This is part of what keeps their broken just-dump-it-all-in-the-install-folder approach working in the modern age, where that stuff is rightfully no longer supported.

That workaround actually had a security bug in it for what was estimated to be the greater part of a decade, which allowed malicious actors that gained access to a user account with minimal permissions to trivially (as in; this literally took three or four commands and less than 10 seconds) co-opt Steam to gain full SYSTEM access and drop a root kit.
Valve patched that iirc around 2018~2019, after initially brushing off the guy that reported it to their HackerOne bug bounty program too.

[Baltasar]

I've done a lot of tests to figure out why this happens on one machine and not on the others:

If I install Steam in the default path (C:\Program Files\Steam), then switching the Windows user works more or less as expected. It still will disconnect from the friends system and basically kill everything that is not a download (= managed by the service), but it will log in to the Steam account of whatever user is now logged in. This is expected behaviour on non-Enterprise Windows systems.

The moment I install Steam in a non-default path, it ♥♥♥♥♥ everything up. The last logged in user will be the user you're being exposed to, no matter what Windows account you're on. I have tried reporting that error to Valve, but they only expose the support staff to us mere users and they were neither aware of the problem nor did they understand the explanation.

Non standard path = everything besides "C:\Program Files\Steam".

To make things worse: The moment Steam is broken due to a non-standard path, it's hard (or even impossible) to recover from this. I don't know where Steam stores that kind of information, but uninstalling the service and hunting down registry keys didn't do the trick and - to make things worse - going back to a pre-Steam checkpoint didn't work. In all cases, I didn't find a way to make it work again besides reinstalling windows.