Whether you’re troubleshooting a system crash, managing application usage, or simply curious about your workflow habits, knowing how to check recently closed apps in Windows 11 can be very helpful. Unfortunately, Windows does not provide a straightforward list of recently closed applications like it does for recently opened documents. Nevertheless, there are several reliable methods that, when used together, can provide meaningful insight into what apps were used and when.
In this article, we will explore various techniques to determine which applications were recently closed on a Windows 11 machine. These methods include using built-in tools, leveraging Windows logs, and utilizing third-party utilities.
1. Using Windows Event Viewer
Probably the most reliable method for tracking recently closed apps is through the Windows Event Viewer. This built-in utility keeps a detailed log of system and application events, which can help identify when applications were launched or terminated.
To view application activity:
- Press Windows + S and type Event Viewer, then press Enter.
- In the Event Viewer, navigate to Windows Logs > Application.
- Filter the logs by clicking on Action > Filter Current Log and choosing an appropriate time frame or event sources like Application Error or Information.
- Scroll through to examine events related to app launches and terminations.
Look specifically for events with IDs like 1000 (Application Error) and 1026 (.NET Runtime) as these often indicate an app was shut down, either normally or abnormally.
2. Checking Task Manager’s App History Tab
Windows Task Manager includes a tab specifically designed to track application usage: App history. While it does not list which apps were recently closed, it provides valuable insight into which applications were run over time.
To use Task Manager for this purpose:
- Press Ctrl + Shift + Esc to open Task Manager.
- Click on the App history tab.
- Review the list of apps and their associated CPU time and network usage.
This tab is especially useful for spotting which applications have been active recently, as greater CPU time typically correlates with recent usage.
Note: This feature only tracks modern apps (e.g., Microsoft Store apps), not classic desktop (.exe) applications.
3. Reviewing Prefetch and Recent Items
Windows maintains metadata of recently accessed applications and files in two helpful directories: Prefetch and Recent Items. These can offer clues about which apps were recently launched and by inference, potentially closed.
Accessing Prefetch:
- Press Windows + R, type prefetch, and press Enter.
- You may need administrative privileges to access this folder.
- Files in this directory contain launch data based on .pf (Prefetch) files.
The dates modified for these files indicate when an app was last executed. While it won’t show an actual ‘closed time,’ it does provide recent usage data.
Accessing Recent Items:
- Press Windows + R, type shell:recent, and press Enter.
- This opens the Recent Items folder, listing shortcuts to recently opened files and documents.
While more targeted toward files, when used together with app data from Prefetch, it can give reliable hints about closed applications.
4. Using Reliability Monitor
Another often overlooked yet powerful tool is the Reliability Monitor. This built-in feature provides a timeline of system events, including software crashes, installations, and terminations.
To access Reliability Monitor:
- Open the Control Panel.
- Navigate to System and Security > Security and Maintenance > Reliability Monitor.
- Here, you can view a graph showing system stability over time.
Click on any day to see a list of application failures, successful installations, and critical events, which gives clear indications about recently closed or crashed programs.
Tip: Hover your mouse over any red ‘X’ or warning triangle to see which application or service the event relates to.
5. Using Windows PowerShell and Command Prompt
If you are more technically inclined, Windows PowerShell and Command Prompt can also provide valuable insights by querying system logs.
PowerShell Command:
You can use the following command to get recent application-related logs:
Get-WinEvent -LogName Application | Where-Object {$_.Message -like "*application name*"} | Select-Object -First 10
Replace application name with the name of the app you’re monitoring. This command fetches entries from the application log that contain the specified name, helpful for identifying start and stop events.
Command Prompt Alternative:
wevtutil qe Application /c:10 /f:text /q:"*"
This provides the 10 most recent entries in the Application event log. It’s more general but can still be useful when combined with specific filtering tools.
6. Utilizing Third-Party Monitoring Tools
If you need detailed tracking over time or prefer a user-friendly interface, consider third-party utilities that specialize in application monitoring. Some of the most trusted options include:
- Process Monitor (Sysinternals) – This advanced tool can log all system activities including process creation, file access, and registry changes.
- LastActivityView (NirSoft) – A lightweight utility that lists a timeline of recent user activity, including executed programs and closed applications.
- What’s Running – Provides a snapshot of the currently running and recently used processes.
These tools offer granular data and long-term tracking some users may require, especially in professional or investigative environments.
7. Set Up Activity Logging for Proactive Monitoring
Instead of trying to look back in time, consider setting up systems that proactively log activity in real time. This can be done through:
- Writing PowerShell scripts that log process start and stop events.
- Using Windows Task Scheduler with custom triggers.
- Implementing enterprise-grade logging with Group Policy and Windows Server settings.
This forward-thinking strategy ensures that next time you need to know what was recently closed, you’ll have all the logs in place already.
Conclusion
While Windows 11 does not provide a direct feature for viewing recently closed apps, it offers numerous tools that, when used intelligently, can help reconstruct recent application usage. Event Viewer and Reliability Monitor stand out as the most informative built-in options, whereas third-party tools like LastActivityView offer quick and detailed insights.
Secure, consistent logging practices are especially important in professional environments for audit, compliance, or security purposes. For casual users, regularly checking Task Manager and setting up minimal logging through PowerShell can already make a big difference.
With a combination of these methods, you’ll be equipped to navigate the somewhat elusive task of tracking recently closed applications in Windows 11.
