Trying to figure out Matrix, and have a few questions on it.

If I log onto a server and there are no other users on it, how can I come across an access ID to spoof with without hacking? If there is a user I can make rolls on him, but was uncertain without another presence what I should be doing.

A Technomancer can or cannot run all their complex forms without concern for their Response?

When I log onto a node, I make (or the GM makes) a Matrix Perception test for me to understand what is around me. So if I logged onto a node that looked like a blue collar bar I would understand that the icon for the bar itself was representative of the firewall within the location? That a bouncer at the door was a rep of the local IC, though I might not know what kind? The dog that I could hear in the back would be a Sniffer or Track program looking for unauthorized users?

If this is a node that I am supposed to be on I will only need to start hiding when I do something I am not supposed to do. So I could walk around the node and inspect all of the Icons to my hearts content without a worry (as long as there is not a user taking note of me). However, when I start Hacking or Spoofing I begin to risk drawing the attention of IC which would be them rolling against my Stealth rating. If I'm on a node that I am not supposed to be on, do they start those rolls immediately?

If someone is running in Hidden mode for their PAN, when I find it can I log onto it or would I need an account? Without being on that node how would I be able to hack up an account?

Thanks, I know I have some more, but this is what I can think of while I am unable to sleep.

Generally, spoofing commands are performed without logging onto a node. Your point stands: you need to learn the access ID to spoof it.

Can.

That is the general idea. Matrix perception checks can be made against nodes and icons. Generally, matrix perception checks are not secret and the player would ask questions about the node/icon. There is a sample list of questions @ SR4a pg228.

There is always an initial test to identify an invalid login. If Hacking on the Fly (SR4a, pg235) that test is made every pass of the extended hacking test (and those successes accumulate). If Probing the Target, the test is once during the node penetration. Other tests would be at the GM discretion (timed interval, unexpected change to the node, etc).

The rules for exploiting are the same no matter the mode the node is in; the difference is locating the node initially. We have an example of a simple hacking flow of The Dumpshock Datahaven Issue #2.

Redjack pretty much has it all there. I was going to be suave and answer something, but I was clearly beaten to it. Well played, sir.