TOEIC LinkPublished May 8, 2026

TOEIC Link screen-recording and screenshot detection — how OS-level capture APIs are monitored and what triggers an exam halt

The TOEIC Link proctoring client detects screen-recording and screenshot attempts at the OS level during the exam. Test content leaving the exam window is the highest-priority information-security risk for the operator, so detection sensitivity is set higher here than for most other policy violations. This guide covers (i) the OS APIs used for detection, (ii) representative tools that get blocked, and (iii) the pre-exam disable steps and during-exam prohibitions.

OS APIs used for screen-capture detection

On Windows, the proctoring client sets SetWindowDisplayAffinity (WDA_MONITOR / WDA_EXCLUDEFROMCAPTURE) on the exam window. This blocks capture at the OS level — Snipping Tool, PrintScreen, Greenshot, and similar tools return a black image. The client also hooks DXGI Output Duplication and flags any external process that begins desktop duplication.

On macOS, the client monitors calls to CGDisplayCreateImage / CGWindowListCreateImage via process audit policies. Screencapture (Cmd+Shift+3/4/5) is OS-native and shows up in the call trace immediately. Third-party screen recorders are flagged at the Screen Recording permission request stage. Since Sequoia, macOS itself emits a monthly reminder for apps holding Screen Recording permission, and the proctoring side observes the presence/absence of that reminder.

On iPad / iOS, the TOEIC Link client monitors ReplayKit (RPScreenRecorder) state. Tapping the screen-record button in Control Center, AirPlay mirroring, USB mirroring to QuickTime Player on a Mac — all are detected. Video output flows that require HDCP protection are blocked.

Dynamic monitoring runs in parallel during the exam. Any new process that requests screen-access permission after the exam starts (ScreenCaptureKit, AVCaptureScreenInput, X11 XGetImage, Wayland screen-capture portal) is flagged immediately. Process launch alone is enough to trigger a warning.

  • Windows: SetWindowDisplayAffinity + DXGI hook monitoring
  • macOS: CGDisplay / CGWindowList APIs + Screen Recording permission monitoring
  • iOS / iPadOS: ReplayKit + AirPlay + USB mirroring detection
  • New capture-process launch during the exam is immediately flagged

Capture tools most often caught

*OS-native tools*: Windows Snipping Tool, Game Bar (Win+G), PrintScreen, macOS Screencapture (Cmd+Shift+3/4/5), iOS screenshot (Power + Volume Up). Being OS-native does not mean allowed. All operations during the exam are logged, and even a single PrintScreen press leaves a warning entry.

*Recording / streaming software*: OBS Studio, Streamlabs, XSplit, NVIDIA ShadowPlay, AMD ReLive, Intel Arc Control. These must be *fully closed* before exam start; if any of them is running in the background, exam start is blocked. OBS is also caught by the Virtual Camera detection flow — it is double-blocked.

*Remote desktop / screen-share apps*: Zoom, Teams, Google Meet, Skype, Discord (screen-share), AnyDesk, TeamViewer, Chrome Remote Desktop, Parsec. Any app with screen-sharing capability is in scope. Active sessions are detected immediately. Even Zoom / Teams without an active meeting can sit in the background in a "share-ready" state, which is enough to trigger detection.

*Screenshot tools*: Greenshot, ShareX, Lightshot, Snagit, Skitch, CleanShot X, Shottr. Resident-style screenshot tools are flagged just by being open.

*Cloud-sync + capture combos*: Dropbox Capture, OneDrive Screenshot Auto-Save, Google Drive Screen Recording, Notion ScreenCapture. Settings that auto-sync screen captures to the cloud are blocked during the exam.

*Browser-extension screen recorders*: Loom Chrome Extension, Vimeo Record, Awesome Screenshot Recorder. These get caught by the extension-detection flow as well — they are double-blocked.

Pre-exam disable and during-exam prohibitions

*1 day before — fully close recording apps*: Quit OBS, Streamlabs, ShadowPlay, ReLive completely. Turn off Windows Game Bar (Xbox Game Bar): Settings > Gaming > Xbox Game Bar > Open Xbox Game Bar = Off. On macOS, quit QuickTime Player if running, and review the apps with Screen Recording permission (System Settings > Privacy & Security > Screen Recording) on Sequoia or later.

*30 min before — fully close screen-share apps*: Quit Zoom, Teams, Slack, Google Meet, Discord *fully* from the system tray (Quit, not the close button). Turn off background notification residency. Even visible screen-share icons in a Slack huddle or Discord voice channel are enough to block exam start.

*30 min before — close screenshot tools*: Quit Greenshot, ShareX, Lightshot, CleanShot X, Snagit, Skitch from the tray / menu bar. Cloud-sync services (Dropbox / OneDrive / Google Drive) themselves can run, but turn off the "auto-upload screen captures" setting in advance.

*15 min before — review system permission lists*: On macOS, audit apps holding Screen Recording permission and turn off everything except essentials. On Windows, review apps allowed under Settings > Privacy > Screenshot Borders.

*5 min before — task manager / activity monitor sweep*: Filter for recording / share process names (obs64, streamlabs, ShadowPlayHelper, zoom, MSTeams, slack, discord) and force-quit anything found. Once proctoring starts, these get enumerated and blocked.

*During the exam — never press PrintScreen / Cmd+Shift+3/4/5*: Do not press them "for note-taking" or "to review later." Each press triggers an immediate warning + a "capture attempt" flag with the proctor. Repeated attempts can lead to exam cancellation and, in the worst case, score invalidation and a retest ban.

Capture-tool detection map

CategoryExamplesDetection result
Recording / streamingOBS / Streamlabs / ShadowPlay🔴 Immediate block
Screen sharingZoom / Teams / Discord share🔴 Immediate block
Remote desktopAnyDesk / TeamViewer / Parsec🔴 Immediate block (also caught by RDP detection)
Screenshot residentGreenshot / ShareX / CleanShot X🔴 Immediate block
OS-native capturePrintScreen / Cmd+Shift+3/4/5🟡 Op-log + warning + black image
Browser-extension recordersLoom / Awesome Screenshot🔴 Double-blocked via extension detection
Cloud auto-sync captureDropbox Capture / OneDrive Screenshot🟡 Detection + setting-off request

* EnglishBlitz observed values. Proctoring engine version and OS updates may change behavior.

Common screen-capture detection messages

  • "Screen recording software detected. Please close OBS Studio and restart the system check."
  • "Screenshot attempt detected. Further attempts will result in exam cancellation."
  • "Active screen sharing session found (Zoom). Please end all sharing sessions before continuing."
  • "Screen capture permission granted to multiple applications. Revoke unnecessary permissions and retry."

Frequently Asked Questions

TOEIC® and TOEIC Link™ are registered trademarks of ETS. EnglishBlitz is not affiliated with, endorsed by, or associated with ETS. This guide is compiled by EnglishBlitz from public information and test-taker experience.