Track Recently Closed Windows Apps: A Practical Guide

Windows doesn’t provide a single “recently closed apps” button the way a phone does, but with a blend of built‑in diagnostics, system logs, and free utilities you can reconstruct what ran and when—often with enough precision for troubleshooting, auditing, or simple curiosity.

Background / Overview​

Windows focuses on current processes and system stability rather than keeping a friendly, human‑facing timeline of every closed application. That means there’s no universal, always‑on “recently closed apps” list for both legacy desktop programs and modern UWP apps. Nevertheless, Windows does record a surprising amount of activity across several places: the Reliability Monitor timeline, Application and System event logs, Task Manager’s App History (for Store/UWP apps), jump lists and Recent Files, and the Restart Manager. Combining those logs with free third‑party tools or a small custom script gets you a reliable history of app starts and stops. Practical workflows range from a one‑click NirSoft utility for casual use to Process Monitor and Event Viewer for forensic depth. Practical download and safety guidance is essential when you add third‑party tools.

---

What Windows records (and what it does not)​

• Windows reliably records errors, crashes, and hangs (these appear in Reliability Monitor and Event Viewer). This is the lowest‑friction place to see unexpected app terminations.
• The Event Log can contain detailed entries for many application lifecycle events if you filter for them, and you can query the logs programmatically.
• Task Manager → App history records cumulative resource use for Store/UWP apps, not exact open/close times, and it must be explicitly reset to clear history.
• Windows does not keep a simple, universal list of every normal app close event like a mobile “recent apps” menu. Normal exits are often not logged unless the application signals an error or the system’s Restart Manager interacts with it. That means you’ll need to stitch together data from multiple sources or enable monitoring.

---

Method 1 — Reliability Monitor: quick, visual troubleshooting​

Reliability Monitor is the easiest built‑in starting point when you want a human‑readable timeline of problems: crashes, application hangs, driver failures, and installation events.

Why use it​

• It’s graphical and easy to interpret for non‑technical users.
• It highlights error icons and gives readable messages about crashes and application failures.

How to open it​

• Press Win + R.
• Type perfmon /rel and press Enter.
• Wait a few seconds for the reliability graph to build.

How to read it​

• Each column is a day; click a day to list events below.
• Look for Application failures and Windows failures; these are the entries most likely to indicate recent forced closures or crashes.

Limitations​

• It primarily shows errors and abnormal exits, not normal user‑initiated closes.
• History is effectively limited (practical visibility is around the last 30 days).
• Not suited for real‑time monitoring.

Use Reliability Monitor first when troubleshooting an application crash or sudden instability—it's fast and requires no downloads.

---

Method 2 — Event Viewer: granular, historic, and scriptable​

Event Viewer is the go‑to when you need timestamps, process names, and event IDs. It’s more powerful than Reliability Monitor but requires deliberate filtering.

What to look for​

• Windows Logs → Application for standard application events and error entries.
• Applications and Services Logs → Microsoft → Windows → AppModel‑Runtime and other subsystem logs for more specialized entries.
• Look for Event IDs tied to application crashes (for example, Application Hang 1002, Error 1000 for crash reports).

Create a focused custom view​

• Open Event Viewer (right‑click Start → Event Viewer).
• Click “Create Custom View”.
• Choose the Application log and set Event IDs you want to capture (common diagnostic IDs include 1000, 1001, 1002, but exact IDs vary by event type).
• Save the view as “Recently Closed Apps” or similar.

This gives you a prefiltered pane that surfaces application terminations and crashes without manual sifting.

Use PowerShell for automated queries​

A quick PowerShell query shows recent application error/warning events:

Get-WinEvent -FilterHashtable @{LogName='Application'; Level=1,2} |
  Where-Object { $_.TimeCreated -gt (Get-Date).AddHours(-24) } |
  Select-Object TimeCreated, ProviderName, Id, Message

This returns errors and warnings from the last 24 hours; tweak the timeframe as needed. Event Viewer + PowerShell is ideal for auditable reports and long‑term log searches.

Strengths and risks​

• Strength: rich history and precise timestamps.
• Risk: verbose logs (information overload) and a steeper learning curve for beginners.

---

Method 3 — Task Manager’s App History: fast check for Microsoft Store apps​

Task Manager includes an App History tab showing CPU time, network usage, and other counters for UWP/Store apps. It’s not a recent‑closure list, but it quickly indicates which Store apps were recently active.

• Great for spotting heavy or suspect Store apps without installing anything.
• Not useful for classic Win32 desktop apps.
• Counters represent cumulative activity since the last reset; click “Delete usage history” to clear them if you want to start fresh.

---

Method 4 — Recent Files, Jump Lists, and Start Menu recommendations​

If your goal is which documents or items were last used (as opposed to every process lifecycle), Windows exposes recent files and jump lists:

• File Explorer → Quick access shows Recent files; the shell:recent folder opens the underlying shortcuts.
• Right‑click a pinned taskbar icon to view a Jump List of recently opened files for that application (useful for Office, Edge, Chrome, etc.).
• The Start menu’s Recommended/Recent area surfaces recently used apps and documents if enabled in Personalization settings.

These are lightweight, user‑facing traces of activity and are often the easiest day‑to‑day way to infer which apps were used recently.

---

Method 5 — NirSoft LastActivityView: simple and portable​

For a user‑friendly, no‑install approach, NirSoft’s LastActivityView consolidates multiple Windows traces into a single table showing open and close times for many events.

What it gives you​

• Timestamps for executions, file openings, and certain app events.
• Export to CSV/HTML for reporting.
• Portable executable (no full install), so it’s easy to run from a USB stick.

Practical notes and safety​

• Download from the official NirSoft page and verify checksums when provided.
• Some antivirus products flag NirSoft tools as suspicious because they access system logs—this is a known false positive in many cases. Confirm authenticity using checksums and your own judgement before running. Prefer doing this in a controlled environment if security policy requires it.

LastActivityView is ideal for general users who want a quick list of recent application activity without configuring Event Viewer or running continuous monitoring.

---

Method 6 — Process Monitor (Sysinternals): for real‑time forensic monitoring​

Process Monitor (Procmon) from Microsoft Sysinternals is the heavy‑duty option for IT pros who need every process create/exit event, file system activity, registry access, and thread info in real time. It captures an enormous amount of data and must be used with filters.

How to set it up for closed‑app tracking​

• Download Procmon and run as Administrator.
• Add filters:
• Operation is Process Create OR Process Exit.
• Exclude system processes you don’t care about.
• Optionally enable “Drop Filtered Events” to keep logs manageable.

Best practices​

• Use short monitoring sessions (Procmon logs grow fast).
• Save filter sets for repeat tasks.
• For serious troubleshooting, combine Procmon traces with Event Viewer and Reliability Monitor entries.

Strengths and risks​

• Strength: unparalleled detail for debugging and malware investigation.
• Risk: massive log sizes and steep analysis complexity. Use only for targeted sessions or in lab environments.

---

Method 7 — DIY: PowerShell process start/stop logger (customizable)​

If you want continuous logging without third‑party binaries, a small PowerShell script can register WMI events for process starts and stops and write them to a local log file.

Example script (core idea)​

$logPath = "C:\AppLogs"
$logFile = "$logPath\activity_log.txt"
New-Item -Path $logPath -ItemType Directory -Force | Out-Null

function Write-Log { param($m) "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - $m" | Out-File -FilePath $logFile -Append }

Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStartTrace" -Action { Write-Log "STARTED: $($event.SourceEventArgs.NewEvent.ProcessName)" }
Register-WmiEvent -Query "SELECT * FROM Win32_ProcessStopTrace"  -Action { Write-Log "STOPPED: $($event.SourceEventArgs.NewEvent.ProcessName)" }

Write-Log "Monitoring started"
while ($true) { Start-Sleep -Seconds 60 }

How to run​

• Save as AppLogger.ps1.
• Run PowerShell as Administrator and, if needed, set ExecutionPolicy RemoteSigned.
• Start the script: .\AppLogger.ps1

Customization ideas​

• Filter for specific executable names.
• Add process ID, parent process, or user name.
• Send alerts (toast notifications, emails) when a critical process exits.

This approach gives you long‑term, auditable logs under your control—but it requires administrative access and careful error handling for production use.

---

Comparison at a glance​

• Reliability Monitor: Easiest; shows crashes/errors (good for quick troubleshooting).
• Event Viewer: Most historically complete and scriptable (requires filtering).
• Task Manager App History: Fast for Store apps; limited for classic desktop apps.
• LastActivityView: Best for casual users—portable and immediate.
• Process Monitor: Best for IT professionals needing full real‑time traces.
• PowerShell logging: Best for long‑term, customizable auditing controlled by you.

---

Security, privacy, and enterprise considerations​

• Always download monitoring tools from official vendor pages or verified repositories; avoid bundled installers and unknown mirrors. Verify code signatures and checksums where available.
• Third‑party monitoring tools can trigger antivirus engines—this is often a benign false positive but treat accordingly. Validate file authenticity before running.
• In corporate environments, coordinate with IT and follow policy: auditing user activity may be subject to legal and privacy rules; many organizations prohibit or restrict installing monitoring tools.
• Log retention and security: if you store logs (local text files, CSV exports), secure them with appropriate permissions and rotate or archive logs to avoid leakage of sensitive activity.

---

Practical workflows: three common scenarios​

1. A casual user wants to know what crashed last night​

• Open Reliability Monitor (perfmon /rel) and scan the last 24–72 hours for red Xs and application failure messages.
• If you need more detail, open Event Viewer → Application and filter for the relevant timestamps and Event IDs.

2. A power user wants a quick full list of recently opened and closed apps​

• Run NirSoft LastActivityView as administrator to get an immediate table of recent activity.
• Export to CSV for timeline analysis; cross‑check with Event Viewer for any entries that look like crashes.

3. IT troubleshooting a performance issue or suspected malware​

• Use Process Monitor with Process Create and Process Exit filters to capture a targeted monitoring window. Save the trace.
• Correlate Procmon output with Event Viewer errors and Reliability Monitor entries.
• If you want a persistent audit, deploy the PowerShell logger centrally or use enterprise tooling (SIEM, endpoint agents).

---

Common questions and practical clarifications​

• Can Windows show every normal app close automatically? No—Windows prioritizes stability/error logging. Normal exits often leave no entry unless an app logs events or is hooked by a monitoring agent. For complete coverage you need an always‑on logger (PowerShell, Procmon, or third‑party agent). fileciteturn0file0turn0file7
• Does Task Manager show closed apps? Not directly—Task Manager shows current processes and cumulative history for UWP apps, not closed events per se. Use Event Viewer or a logger for that.
• Is LastActivityView safe? Widely used by technicians; download from official NirSoft distribution and verify files. AV false positives happen—check signatures/checksums.

---

Critical analysis — strengths and potential risks​

Strengths​

• The combination of built‑in utilities plus free tools offers flexible coverage for every competence level: beginners get Reliability Monitor and jump lists; power users get Event Viewer/Procmon; administrators can run persistent PowerShell logging.
• Most methods are free and require no ongoing subscription or heavy infrastructure. fileciteturn0file0turn0file7
• For forensic troubleshooting, Process Monitor plus Event Viewer provides complementary, high‑fidelity evidence about what ran and why it failed. fileciteturn0file7turn0file2

Risks and blind spots​

• No single tool records all normal closures by default; achieving complete coverage requires enabling logging or running a monitor continuously, which creates storage, privacy, and performance tradeoffs.
• Real‑time capture (Procmon) can produce massive log files very quickly; logs must be filtered and archived responsibly.
• Third‑party tools and portable utilities can trigger endpoint protection and may be restricted by corporate policy. Validate binaries and coordinate with IT before deploying widely.
• Relying on GUI features (Timeline, Recommended) is fragile: Microsoft has changed or removed some Activity History features across Windows 10 and Windows 11 builds, so don’t assume a classic “Timeline” experience will be present on every machine or build. Verify on the target device before making recommendations. fileciteturn0file0turn0file2

---

Final recommendations — a practical starter kit​

• If you only need occasional checks: use Reliability Monitor and Jump Lists first. Quick and safe.
• If you want an immediate, easy inventory of recent activity: run NirSoft LastActivityView from an official download. Verify the file and be prepared for AV false positives.
• If you need one‑time deep analysis: launch Procmon with Process Create/Exit filters, reproduce the issue, then stop and archive the trace. Use Event Viewer to fill in the longer history. fileciteturn0file7turn0file2
• If you want persistent, auditable logs you control: deploy a lightweight PowerShell WMI logger, secure the logs, and rotate them regularly.

---

Windows doesn’t make it obvious, but it does give you the raw materials to build a reliable record of what ran and when—if you pick the right tool for the job. For casual checks start with Reliability Monitor or LastActivityView; when the problem or audit requirement is serious, move to Event Viewer, Procmon, or a custom logger. Always verify third‑party binaries, respect privacy and corporate policies, and remember that perfect completeness requires continuous logging and careful retention policies. fileciteturn0file0turn0file2turn0file7
Conclusion
Finding recently closed apps in Windows 11 or 10 is not a single‑click feature, but a practical set of proven options exists: use Reliability Monitor for quick problem spotting, Event Viewer and PowerShell for historic and scriptable evidence, LastActivityView for a simple consolidated view, and Process Monitor or a custom script when you need forensic fidelity. Each method balances ease, depth, and data volume differently—choose the combination that matches your technical comfort, privacy constraints, and the detail you need. fileciteturn0file0turn0file9turn0file7

---

Source: H2S Media How to Find Recently Closed Apps in Windows 11/10 [Built-in + Free Tools]