How to PC check a player on FiveM

A FiveM PC check, also called a screenshare, is when server staff check a suspected player's computer for cheats. With a forensic scanner it takes four steps: staff create a scan pin, the player downloads the scanner and enters the pin, the scan reads the PC, and staff review the report before they decide on a ban.

Ocean Anti-Cheat is a forensic screenshare tool for game server staff that reads the traces a cheat leaves on a player's PC, including the ones they tried to hide. The steps below follow Ocean's own flow, as the downloads page and the FiveM detection docs describe it.

Step 1: Create a scan pin

A staff member creates a pin in the Ocean dashboard and sends it to the player. The pin has eight characters, and pins expire about three hours after they are created, so create one when the player is ready to scan.

FiveM needs a paid licence, because Ocean is free only for Minecraft. On the pricing page as of 2026-10-30, a personal FiveM licence costs $10 a month, $44.99 for six months or $79.99 a year, and Enterprise plans add staff slots.

Step 2: The player downloads the scanner and enters the pin

The player opens anticheat.ac/downloads, picks Windows or Linux and enters the eight-character pin to get the right scanner. If Ocean will not start because of a Visual C++ runtime error, the downloads page gives the fix: install the x64 Visual C++ redistributable from Microsoft, restart the PC and run Ocean again.

Step 3: Let the scan run

A typical scan takes about 60 seconds. Hardware, system activity and the detection rules you enable can change the duration. Ocean runs as a protected process, so the player cannot close it from Task Manager while it scans.

The scan looks at what is running and at what ran before the scan: execution history from Windows artifacts such as Prefetch, Amcache, ShimCache, BAM and event logs, loaded modules, memory, and files deleted before the scan, which it recovers on NTFS and FAT32 drives. That matters because a cheat closed five minutes before the check never shows up in a tool that only looks at running processes.

For FiveM, the FiveM detect logs include these detections:

• Generic Cheat Injection: an illegal external injection into the game.
• Game Hooking: a hooked import in the game process, which points to an injection.
• Generic Cheat Render and Generic Game Cheat Render: a GUI or render module from outside the game injected into it.
• Folder Modification: files created, deleted, overwritten or edited in folders that matter in a screenshare, such as the Grand Theft Auto folder and the FiveM AI and mods folders.
• Suspicious Unloaded Module: a DLL unloaded from the game process.
• GlobalBan Patching and Active Spoofer: attempts to get around a CitizenFX or server ban.
• Possible Loaded Cheat: a DLL from outside the game injected into it. The docs note that it can be a false positive with ReShade on FiveM.

Step 4: Review the report and decide

The result opens in the dashboard as soon as the scan ends. Ocean sorts what it finds so staff know what is proof and what needs a look:

• Detect logs are confirmed detections: direct residues of a known cheat, generic highly suspicious executables and specific tampering methods.
• Warning logs are modifications that can be used to evade detection but are not proof on their own. Your server decides the penalty.
• Suspicious logs are executables flagged with a reason, such as packers and protectors, .NET tooling, VM checks or macro tools. Read the reason, then check manually.

The report also rates signs that the PC was cleaned before the scan, from none to high, lays out a forensic timeline of what happened on the PC before the scan, and exports a complete report you can keep as proof behind a ban. The detection docs explain each detection, warning and integrity check.

A manual check or a scanner?

A manual screenshare ties up a staff member and a player on a call, and what it finds depends on what the staff member thinks to open. A scanner checks the same places on every PC, and anyone on your staff can review the report later from the dashboard.

If you are choosing a tool, see how Ocean compares with Detect.ac, Echo and Napse.