Which app is using your camera or microphone?

What Windows gives you, and where it stops

Windows has solid camera and microphone privacy controls: you can turn device access off globally or per app, and Settings shows recent activity per app. What is missing is a single process-attributed view designed for triage, current use and history side by side, watchable live, and correlated with the rest of a security review.

What WinSight shows

• Current use: which process has the webcam or microphone on right now, for example “Microphone ON → zoom.exe (pid 8812)”.
• History: which applications used each device and when, from the Capability Access records Windows itself maintains.
• Live watch: winsight av --watch streams transitions from the command line the moment a device turns on or off.
• A path to act: each finding links to the exact Windows privacy settings page where you can revoke an app’s access.

Limits, stated plainly

• WinSight reads the Capability Access accounting that Windows maintains for both packaged (Store) and classic desktop apps. Software that bypasses Windows’ capability accounting (for example a kernel-level implant) is out of scope, and WinSight does not claim hardware-level surveillance detection.
• This is visibility, not blocking: WinSight never turns your devices off itself. Revoking access stays in Windows Settings, where it belongs.
• Analysis stays on the device; nothing is uploaded.