Find Recently Used Applications using SCCM CMPivot Query

In this article, we will find recently used applications using CMPivot query in SCCM. On any SCCM managed computer, you can find what applications were most used with CMPivot query.

A recently used application here means the applications that were launched and used by user. An example of used applications could be browser, console, service etc.

The CMPivot is a very useful feature in Configuration Manager. CMPivot allows you to quickly assess the state of devices in your environment and take suitable action.

The CMPivot queries are pretty useful when you want to find critical information from your managed clients. I love the CMPivot because it is so simple to get the information from your devices.

CMPivot makes it easy to find recently used applications from a computer or set of devices. You can learn about CMPivot basics from Microsoft CMPivot documentation.

If you want to find the list of installed softwares, refer to the following guide: Find Installed Software using SCCM CMPivot.

In this blog, we have seen numerous examples of CMPivot queries, and I am listing some important ones below.

• Find Dot Net Version using SCCM CMPivot Query
• CMPivot Query to Find TPM Status and Details
• Find Windows 11 Versions using SCCM | SQL | CMPivot
• Find Default Browser using SCCM CMPivot Query
• Query Registry Value using CMPivot Query

Find Recently Used Applications using SCCM CMPivot Query

Let’s see how to find recently used applications using SCCM CMPivot query.

• Click Start and launch the SCCM (Configuration Manager) console.
• Navigate to Assets and Compliance > Overview > Device Collections.
• Right-click a device collection and select Start CMPivot.

Note: You can run the CMPivot on a device collection or on a single computer. The devices have to be online to retrieve the used applications on them.

In the query tab, enter the below CMPivot query and click Run Query to find the recently used applications.

CCMRecentlyUsedApplications | where (LastUsedTime > ago(2h)) | project CompanyName, ProductName, ProductVersion, LastUsedTime

In the above command, the lastusedtime is set to 2 hours. You can change this value and set it according to your requirements.

In the CMPivot query output, we see a list of all recently used applications along with last used time, Company Name, Product Name, Product Version. You can export the entire CMPivot query output to a CSV file.

Using CCMRecentlyUsedApplications CMPivot Query

“CCMRecentlyUsedApplications” helps you find the recently used applications on the computers. You can also include additional details in the output such as Company Name, Product Name, Product Version and Last used time of application.

If you only run the command CCMRecentlyUsedApplications on a single computer, the CMPivot query output will have the following details.

• Device
• Additional Product Codes
• Company Name
• Explorer File Name
• File Description
• File Properties Hash
• File Size
• File Version
• Folder Path
• Last Used Time
• Last Username
• Launch Count
• MSI name
• Product Language
• Product Name
• Product version
• Launch Count

Find Applications used by User with CMPivot Query

If you want to find the applications used by a specific user, it is possible with CMPivot query. On a computer, there can be multiple users logged in, and you can find the applications used by a specific user.

In the CMPivot query tab, enter the following query to find the applications used by a specific user. In the command, you have to replace the username with correct name and run the query.

CCMRecentlyUsedApplications | where Lastusername == 'mecmlab\cmadmin'

Bonus Query: You can combine the above two CMPivot queries (lastusedtime and Lastusername) to find the recently used applications by a user in specific time and display additional details.

CCMRecentlyUsedApplications | where (LastUsedTime > ago(8h)) and (Lastusername == 'mecmlab\cmadmin')
| project CompanyName, ProductName, ProductVersion, LastUsedTime