115

New with Windows 10 seems to be the Notification Area. Now, I've seen a few notifications (in the Action Center). The problem is that I haven't understood any of them (actively using computers for 30 years now), and once I click them they are gone. Is there any way to view these past user notifications so I can try and make some sense out of them?

Samir
  • 20,527
  • 74
  • 166
  • 226
Maarten Bodewes
  • 1,759
  • 2
  • 10
  • 19
  • Once you click them something related should happen. They shouldn't just dissappear, they cause some action. – gronostaj Jul 30 '15 at 22:49
  • 7
    Yes, that they do. And I get for instance a bunch of startup applications. But I cannot remember for the life of it what I should do with those. Some kind of optimization or something. But after I clicked the darn message that didn't make any sense in the first place, it's gone. – Maarten Bodewes Jul 30 '15 at 23:05
  • 4
    Just noticed this behavior in Server 2016 (preview 5). The message said something about removing some apps at startup to improve performance - you click on it and Task Manager opens. Not very helpful at all. – gchq Oct 15 '16 at 22:39
  • 2
    Thanks for the question. Disappointed in the answer, but without the question I would not have confirmation of what I feared. – Michael Felt Dec 20 '18 at 07:39
  • 4
    In **Windows 11** this gets better: notifications that you don't click on fast enough (about 3 seconds) disappear without a trace too. – Bob Stein Aug 04 '21 at 18:28

4 Answers4

48

tldr; No there's not.

The action center is the same as found on the Microsoft Phones running Windows 10 Mobile. These actions (notifications) are meant to be displayed to the user until they take action. There are two ways a user can interact with an action:

  1. Dismiss the notification (clears the action)
  2. Select the notification (respond to the action)

Once one of these interactions takes place, the notification and therefore the action is no longer displayed. No history is maintained of these notifications and cannot be retrieved. This is done on purpose as that history could (and most likely would) become very large.

If you are worried that the notification has system-wide consequences it could be worth looking into the System logs instead; here separate messages about system events are stored.

Update: It appears that some applications will additionally add events into the event viewer. This can be done by:

  1. Open Event Viewer
  2. Expand Applications and Services Logs
  3. Drill down to the app or service you are interested in, e.g. for Windows Defender you might go to: Microsoft -> Windows -> Windows Defender -> Operational log.
  4. Review the log and look for the notification you were interested in.

This is NOT the notification history, but additional information provided by the application and as such, there's no guarantee that the notification was logged. It also requires that a user knows which application whose notification they're looking for.

James Mertz
  • 26,224
  • 41
  • 111
  • 163
  • Comments are not for extended discussion; this conversation has been [moved to chat](http://chat.stackexchange.com/rooms/71179/discussion-on-answer-by-kronos-view-past-notifications-in-windows-10). – Journeyman Geek Jan 04 '18 at 13:09
  • 30
    Another brain-dead design decision by Microsoft. If the concern is that history could become very large, the simple situation is to just keep the most recent notifications, i.e. within the last week or month or year - perhaps, make it configurable, too, while you're at it. Duh!! – Ajoy Bhatia Sep 24 '18 at 17:21
  • @AjoyBhatia I don't know of any other system that does this. How is this a "brain-dead design design decision by **Microsoft**"? – James Mertz Sep 29 '18 at 06:20
  • @KronoS - because Microsoft developed Windows 10? – Ajoy Bhatia Oct 01 '18 at 18:01
  • @AjoyBhatia point I'm trying to make here is that Microsoft, Apple, and Unix like OS's all don't do this. Can't really fault just Microsoft for this entirely. – James Mertz Oct 02 '18 at 03:23
  • 5
    It doesn't make this nonsense any better if others do the same. But really, of all the systems I have used, including the ones mentioned, and of course my phone, I never had this issue. Notifications don't just disappear with no trace without me making them disappear. Only on Win10 they do. – Ralf Oct 17 '18 at 19:51
  • 2
    @Ralf that's not the behavior that we're talking about here. That indeed is something that shouldn't happen and if you encounter should be reported as an error to Microsoft. However, this situation is one were the user intentionally dismissed the action and then wants to get it back. – James Mertz Oct 19 '18 at 03:27
  • 3
    Notifications, in my experience, do disappear after a time. For W10 that time seems to be 0 seconds, rather than, e.g., one week, and the option to delete them earlier. – Michael Felt Dec 20 '18 at 07:42
  • "No history is maintained of these notifications and cannot be retrieved" - this is *wrong*, Notifications are stored in C:\Users\%username%\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db as SQLLite db and can be restored. – setec May 04 '23 at 11:19
  • _"This is done on purpose as that history could (and most likely would) become very large."_ Well, I only receive one or two per week, at most. But they could come _every minute_ and _still couldn't even come close_ to all the space obnoxiously eaten up by Windows apparently without the slightest bit of scruples. – Sz. Jun 10 '23 at 13:45
11

You can use a paid Notification Logger app from the Microsoft Store to view past notifications history. I'm the author of this app.

Eugene Gagarin
  • 121
  • 1
  • 3
  • Nice, I'll sure check it out (when I upgrade my laptop which is out of space or convert my Linux PC). – Maarten Bodewes May 05 '20 at 22:11
  • Bought it, thanks. Looks like it will work great! I needed this because Microsoft doesn't allow an infinite timeout for notifications and I'm using the Visual Ping plugin for Chrome. When I'm not at my PC the notifications disappear, making it useless. – glenviewjeff May 14 '20 at 01:35
  • Yes: bought it too. THANKS. I do not see, however, a way to create a desktop shortcut for it, which is how I'd prefer to access it. (For now, I've pinned it to my taskbar, which is already too full ... but oh well.) – Doug_Ivison Apr 27 '21 at 10:05
  • 4
    @Doug_Ivison, thanks! You could [drag](https://docs.microsoft.com/en-us/answers/questions/3414/uwp-create-desktop-shortcut-after-install-from-sto.html) the app from start menu to desktop, it will generate shortcut automatically. – Eugene Gagarin Apr 28 '21 at 11:34
  • 2
    @EugeneGagarin -- ty, yes -- that worked. – Doug_Ivison May 01 '21 at 17:52
  • I assume though this only works with notifications that occur after it's installed and running? I just saw a notification that I'd really like to get back but can't find it anywhere... – Dylan Nicholson May 19 '21 at 22:35
  • 1
    @DylanNicholson yes, you're absolutely right – Eugene Gagarin May 22 '21 at 13:42
  • Thank you very much for your app! Just buy it. I dont like to ask this here, but i dont have any other way to contact u. I need to have the whole request data from the notifications. It would literally change my life... Please contact me.. jadethepineapple(@)gmail . THANK YOU !!!! – Jade Hamel Aug 01 '22 at 05:01
  • @EugeneGagarin I just bought it! However, I don't see a way to interact with the notification's link. For example, Twitter notifications, open the tweet they are related to if you click them in the Windows notification bar, but the link is gone inside the Notification logger table. Am I doing something wrong? – Saxtus Dec 30 '22 at 16:40
  • @Saxtus thanks, unfortunately it's not possible to extract the link from a notification. – Eugene Gagarin Jan 09 '23 at 11:17
9

I've found one way to view past notifications, though only very recent ones. In Windows 10, the notifications are stored in \Users\<username>\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db as an SQLite database. E.g. using DB Browser for SQLite, it is possible to view the "Notification" table in it, whose "Payload" column contains the notification texts.

Now, this database doesn't actually seem to store notification history, and dismissed notifications are immediately deleted, but there is a trick: since it is an SQLite database with write-ahead logging (WAL), it may be possible to view an earlier version of the database with the relevant notification.

For example, say I accidentally dismissed a notification without being able to read it. In the aforementioned directory, there exists wpndatabase.db file, last modified two hours ago, and wpndatabase.db-wal file, last modified just now. If I copy both files to a different directory and then open wpndatabase.db in DB Browser for SQLite, I will view the latest version of the database, with the relevant notification gone. However, if I copy only the wpndatabase.db file and open it, I will view the snapshot from two hours ago, before I dismissed the notification, so I will be able to view it.

This is the easiest scenario. What if I dismissed the notification hours/days ago, earlier than wpndatabase.db last modified time? Then this means changes will have been incorporated into the database file and it is not possible to view that notification anymore. Conversely, what if both the arrival and dismissal of the notification happened later than wpndatabase.db last modified time? Then the wpndatabase.db file alone will not have it, but it should still be contained in the log at wpndatabase.db-wal. So you need to apply only the first part of the log to the database, before the deletion. I haven't looked at how to do this or if it is easily doable just using DB Browser for SQLite, but I am sure it is in principle possible to do since the .db-wal file is just a log of changes.

Debie Downer
  • 536
  • 6
  • 8
  • 1
    BTW that's a huge security backdoor, and this 'feature' of windows notifications is often used by forensics specialists. – setec May 04 '23 at 11:21
  • @setec, which exact aspect of this is a "huge security backdoor"? – Sz. Jun 10 '23 at 13:52
3

The accepted answer may have been right at the time of writing but is no longer correct. As mentioned in Debie Downer's answer Windows 10/11 stores notifications in an SQLite database, so there's a decent chance of finding the associated write-ahead log file [usually C:\Users\<username>\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-wal]

If you have the WAL file, you can drop it in a web-app that can open these files such as this https://filext.com/file-extension/SQLITE-WAL. I wouldn't trust this site for sensitive data, but it's a quick way to see the contents. You can perform a text search on the readable bytes of the file.

Also, there are more sophisticated forensic tools like this one that let you visualize the data.

Shravan
  • 173
  • 10