How to Check When an App Was Last Accessed in Windows 10

Windows 10 does not provide one built-in list showing the last time every app was opened. For a quick lookup, use LastActivityView, a free portable utility that gathers activity records from several places in Windows. Its Action Time can help you find a recent app launch, but it is a recorded event—not proof that someone actively used the app.

Check an app’s last recorded activity with LastActivityView

1. Download and extract the utility. Get LastActivityView from the official NirSoft page. Choose the ZIP for your system, save it, and extract the files. NirSoft says the tool does not need an installer or extra DLL files; run LastActivityView.exe from the extracted folder.

2. Find the app’s activity rows. When LastActivityView opens, it scans activity information available on the PC and displays a table. Look at Filename for the program’s executable, such as notepad.exe, and check the related Action. A “Run .EXE file” entry means a process started; it may have been started by a person, another program, or a background service.

3. Filter the list or sort it by time. To narrow a large log, choose View > Use Quick Filter, then type part of the executable name. Quick Filter shows rows containing the text you enter. You can also select the Action Time or Filename column header to sort the table, then scan the matching rows. If the app’s display name is unfamiliar, search for its executable name instead.

4. Read Action Time and Data Source together. Select the matching row and check its Action Time for the recorded date and time. Then inspect Data Source, which identifies the registry key, file, or other source that supplied that activity record. If you need to keep a copy, select the row and use Ctrl+S to save the selected records in a supported format such as CSV, HTML, XML, or tab-delimited text.

What the timestamp can—and cannot—tell you

LastActivityView combines information from sources including the Windows Registry, Windows event logs, and the Prefetch folder. NirSoft warns that the availability and accuracy of entries vary by PC. For example, a registry change can affect a time derived from a registry key’s modified date. Some event types also have their own recording limits.

Use the result as a clue about a recorded launch or other activity. It does not show how long an app stayed open, whether its window was in the foreground, or whether a person interacted with it. A missing row also does not prove the app was never opened: Windows may not have retained a usable record for that event. NirSoft documents these limits on its LastActivityView page.

A “Run .EXE file” row can also reflect a helper program or background service starting a process. If the date matters, compare the row with other available records and check whether its action and source fit the situation you are investigating.

Why Task Manager may not answer the same question

Windows 10 Task Manager has an App History tab, but it summarizes resource usage such as CPU time and network activity over time. It is useful for comparing app resource use, not for looking up one reliable “last opened” timestamp across every desktop and Store app. See Microsoft’s Task Manager overview for the tab’s purpose.

Need a record of future app launches?

For process-start records going forward, an administrator can enable Success auditing for Audit Process Creation in Local Security Policy or an organization’s Group Policy. Then open Event Viewer, go to Windows Logs > Security, and filter for event ID 4688 (“A new process has been created”). Microsoft notes that process-creation auditing records the application and account and can generate medium-to-high event volume depending on activity. It only records events after auditing is enabled, and it records process starts—not proof of interactive use. See Microsoft’s Audit Process Creation guide and event 4688 reference.