105

New with Windows 10 seems to be the Notification Area. Now, I've seen a few notifications (in the Action Center). The problem is that I haven't understood any of them (actively using computers for 30 years now), and once I click them they are gone. Is there any way to view these past user notifications so I can try and make some sense out of them?

5
  • Once you click them something related should happen. They shouldn't just dissappear, they cause some action.
    – gronostaj
    Jul 30, 2015 at 22:49
  • 7
    Yes, that they do. And I get for instance a bunch of startup applications. But I cannot remember for the life of it what I should do with those. Some kind of optimization or something. But after I clicked the darn message that didn't make any sense in the first place, it's gone. Jul 30, 2015 at 23:05
  • 3
    Just noticed this behavior in Server 2016 (preview 5). The message said something about removing some apps at startup to improve performance - you click on it and Task Manager opens. Not very helpful at all.
    – gchq
    Oct 15, 2016 at 22:39
  • 1
    Thanks for the question. Disappointed in the answer, but without the question I would not have confirmation of what I feared. Dec 20, 2018 at 7:39
  • 2
    In Windows 11 this gets better: notifications that you don't click on fast enough (about 3 seconds) disappear without a trace too.
    – Bob Stein
    Aug 4, 2021 at 18:28

4 Answers 4

46

tldr; No there's not.

The action center is the same as found on the Microsoft Phones running Windows 10 Mobile. These actions (notifications) are meant to be displayed to the user until they take action. There are two ways a user can interact with an action:

  1. Dismiss the notification (clears the action)
  2. Select the notification (respond to the action)

Once one of these interactions takes place, the notification and therefore the action is no longer displayed. No history is maintained of these notifications and cannot be retrieved. This is done on purpose as that history could (and most likely would) become very large.

If you are worried that the notification has system-wide consequences it could be worth looking into the System logs instead; here separate messages about system events are stored.


Update: It appears that some applications will additionally add events into the event viewer. This can be done by:

  1. Open Event Viewer
  2. Expand Applications and Services Logs
  3. Drill down to the app or service you are interested in, e.g. for Windows Defender you might go to: Microsoft -> Windows -> Windows Defender -> Operational log.
  4. Review the log and look for the notification you were interested in.

This is NOT the notification history, but additional information provided by the application and as such, there's no guarantee that the notification was logged. It also requires that a user knows which application whose notification they're looking for.

8
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Journeyman Geek
    Jan 4, 2018 at 13:09
  • 24
    Another brain-dead design decision by Microsoft. If the concern is that history could become very large, the simple situation is to just keep the most recent notifications, i.e. within the last week or month or year - perhaps, make it configurable, too, while you're at it. Duh!! Sep 24, 2018 at 17:21
  • 4
    It doesn't make this nonsense any better if others do the same. But really, of all the systems I have used, including the ones mentioned, and of course my phone, I never had this issue. Notifications don't just disappear with no trace without me making them disappear. Only on Win10 they do.
    – Ralf
    Oct 17, 2018 at 19:51
  • 1
    @Ralf that's not the behavior that we're talking about here. That indeed is something that shouldn't happen and if you encounter should be reported as an error to Microsoft. However, this situation is one were the user intentionally dismissed the action and then wants to get it back. Oct 19, 2018 at 3:27
  • 3
    Notifications, in my experience, do disappear after a time. For W10 that time seems to be 0 seconds, rather than, e.g., one week, and the option to delete them earlier. Dec 20, 2018 at 7:42
10

You can use a paid Notification Logger app from the Microsoft Store to view past notifications history. I'm the author of this app.

8
  • Nice, I'll sure check it out (when I upgrade my laptop which is out of space or convert my Linux PC). May 5, 2020 at 22:11
  • Bought it, thanks. Looks like it will work great! I needed this because Microsoft doesn't allow an infinite timeout for notifications and I'm using the Visual Ping plugin for Chrome. When I'm not at my PC the notifications disappear, making it useless. May 14, 2020 at 1:35
  • 4
    @Doug_Ivison, thanks! You could drag the app from start menu to desktop, it will generate shortcut automatically. Apr 28, 2021 at 11:34
  • 2
    @EugeneGagarin -- ty, yes -- that worked. May 1, 2021 at 17:52
  • 1
    @DylanNicholson yes, you're absolutely right May 22, 2021 at 13:42
4

I've found one way to view past notifications, though only very recent ones. In Windows 10, the notifications are stored in \Users\<username>\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db as an SQLite database. E.g. using DB Browser for SQLite, it is possible to view the "Notification" table in it, whose "Payload" column contains the notification texts.

Now, this database doesn't actually seem to store notification history, and dismissed notifications are immediately deleted, but there is a trick: since it is an SQLite database with write-ahead logging (WAL), it may be possible to view an earlier version of the database with the relevant notification.

For example, say I accidentally dismissed a notification without being able to read it. In the aforementioned directory, there exists wpndatabase.db file, last modified two hours ago, and wpndatabase.db-wal file, last modified just now. If I copy both files to a different directory and then open wpndatabase.db in DB Browser for SQLite, I will view the latest version of the database, with the relevant notification gone. However, if I copy only the wpndatabase.db file and open it, I will view the snapshot from two hours ago, before I dismissed the notification, so I will be able to view it.

This is the easiest scenario. What if I dismissed the notification hours/days ago, earlier than wpndatabase.db last modified time? Then this means changes will have been incorporated into the database file and it is not possible to view that notification anymore. Conversely, what if both the arrival and dismissal of the notification happened later than wpndatabase.db last modified time? Then the wpndatabase.db file alone will not have it, but it should still be contained in the log at wpndatabase.db-wal. So you need to apply only the first part of the log to the database, before the deletion. I haven't looked at how to do this or if it is easily doable just using DB Browser for SQLite, but I am sure it is in principle possible to do since the .db-wal file is just a log of changes.

1

The accepted answer may have been right at the time of writing but is no longer correct. As mentioned in Debie Downer's answer Windows 10/11 stores notifications in an SQLite database, so there's a decent chance of finding the associated write-ahead log file [usually C:\Users\<username>\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-wal]

If you have the WAL file, you can drop it in a web-app that can open these files such as this https://filext.com/file-extension/SQLITE-WAL. I wouldn't trust this site for sensitive data, but it's a quick way to see the contents. You can perform a text search on the readable bytes of the file.

There are also sophisticated (mostly paid) forensic tools like this one that let to visualize the data.

Not the answer you're looking for? Browse other questions tagged or ask your own question.