How To View User Activities In Windows

Recently opened documents was a feature of Windows until Windows XP. It would give us a list of documents recently opened by a user in Windows. But Windows 7 and Windows 8 do not have anything related to the history of user activities. NirSoft has released a small portable utility called LastActivityView which will automatically show recent user activities in Windows even without installation.


It will give you a wealth of information including the applications opened by the user, user logon, sleep, shutdown timings, folders opened, networks accessed, user hangs and software crashes, BSODs etc. The interesting thing is that it does not require any monitoring service to record all this. It will automatically populate the data analyzing logs from various information sources including Event viewer logs, registery keys and other Operating System logs.

As always with any NirSoft utility, LastActivityView is super easy to use. Since it does not have to be installed, you only have to open the LastActivityView.exe file from the downloaded archive and it’ll start showing the history of user activities.

Unfortunately, there’s not much in the user interface. There should have been a filter option which could allow us to filter out specific type of activities. You can use the Find function which will cycle through the items sequentially.

There is a workaround though. You can export the information provided by LastActivityView as txt, csv or xml files or even create an HTML report file. You can export the activity information to a csv file and then user the filter feature in Excel to select one type of user activity.

You can click on the first row items in order to sort the list of activities by time, description, filename and full path. You can also change the time of user activities to show GMT instead of the local time. Just go to Options and select Show time in GMT.

This nifty portable utility can be a handy tool especially for administrators for troubleshooting purposes. The administrators can go through the user activities to diagnose what had happened and which files were opened during a system crash.