User presence detection for altering operation of a computing system

Various technologies and techniques are disclosed that modify a computer system based on user presence detection. An input device detects whether a user is present and adjusts the operation of an application accordingly. For example, ports or services can be disabled to increase security, a logging operation can be increased, a port or service that was previously disabled can be enabled, at least one system feature based on a number of users present can be adjusted, etc. If the user is detected to be absent, for example, then the system can disable at least one system port or service that does not need to be enabled while the user is absent to increase the security state of the computer. An attack directory can be accessed to retrieve information about the most likely services to be attacked, and that information can be used to help determine what services to disable.