In that case, when you can't get users out, it is possible to add PID to the Windows Task Scheduler (View - Select Columns) and look for the extra threads that way. I always add the Command Line to the list too, so I am sure to be looking at client threads and not the service.