How to take a screenshot of another user’s desktop in OS X

DesktopAndScreenSaverIconXOne of the popular features of OS X is its built-in screenshot ability, where by pressing Shift-Command-3 you can capture an image of your current screen output to your desktop. This ability allows you to save a record of whatever you are looking at, which has numerous conveniences. By default screenshots will only capture what you see on your screen; however, if needed you can also take a screenshot of another user’s screen without needing to switch your view.

If you have Remote Management enabled on the target system, then you can view your Mac’s current screen from another one, and then take a screenshot. However, this only works for the current active user, and not one who may be logged in but hidden by Fast User Switching.

Taking a screenshot of any user’s desktop just takes a couple of Terminal commands that can be done either locally, or remotely if you are logged into your system via SSH, and will be done without the targeted user knowing the screenshot has been taken. Keep in mind this ability does require you have full administrative rights for your Mac, and also requires the targeted user be logged in.

First you will need to determine which users are logged into a graphical session on your Mac. While you can list the current users by running the command “users” in the Terminal, this is not sufficient as these may be non-graphical sessions (e.g., SSH logins). Therefore, you need to determine who is logged onto your Mac graphically, which can be done in two ways:

  1. Access the Fast User Switching menu and see which accounts have checkmarks next to their names. You can then get the UID for usernames in the Fast User Switching menu by running the following command in the Terminal, replacing “USER NAME” with that as you see it in the menu:
    id -u "USER NAME"
  2. Run the following Terminal command on the system:
    top -stats uid,user,command -l 1 | grep loginwindow

This command will run the “top” process viewer utility once, and only display User ID, User Name, Process ID, and Process Names. It will then filter these to only show the “loginwindow” processes that are running. Since OS X dedicates one loginwindow process to each user session, this will output something like the following, which will give you the User ID you need for the accounts currently running graphical sessions on your Mac:

503 zephyr   loginwindow
502 tkessler loginwindow

Note that you can also use the Finder or Dock processes, as these are also only present as one instance during graphical logins for a given user.


Now you can use the target user’s ID in the following command (replace UID with the target user’s ID number, and FILENAME with the desired file name) to capture an image of his or her screen (provide your password when prompted):

sudo launchctl asuser UID screencapture ~/FILENAME.png

For example, the loginwindow processes listed above show me (tkessler) being logged in along with a user “zephyr.” When logged into my account, provided I have administrative rights, I can take a screenshot of the account “zephyr” by running the following command:

sudo launchctl asuser 503 screencapture ~/zephyrshot.png

This command will instruct the system launcher to run the screencapture command as the designated user, which in this case is the UID of the target user, and then save the resulting file to your home directory.

Previewing Tips

Once the file is saved, you can preview it in the Finder while in Column view, which can be useful for monitoring updates, as you can quickly run the command again to capture and replace the current image file. The Finder will immediately preview the updates for you. The same can be done if you open the image in Preview; however, taking another screenshot will reload the image in Preview and reset any image resizing done to get a better view of the image.

To take rapid updates, you can press the Up arrow in the Terminal to load the screenshot command again so you can execute it with Enter. Note that “sudo” commands will only require your password after 10 minutes has elapsed since you ran a previous sudo-based command, so this should execute immediately.