# Script to fetch browsing history on Windows devices Employees in an organization may use their company-owned devices for non-work-related purposes. Admins can inspect employees’ browsing histories to understand what they have surfed on the internet with their corporate devices. However, manually checking the browsing history on every device is tiresome. Hence, you can [deploy scripts](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/) from the Hexnode portal to fetch browsing history from Windows devices remotely. Note: **Supported Versions**: The scripts given below will be supported on the following versions: - Windows 10 v1607+ (Pro, Enterprise, Education) - Windows 11 (Pro, Enterprise, Education) Disclaimer:The sample scripts provided below are adapted from third-party open-source sites. PowerShell script to get the browsing history of Google Chrome -------------------------------------------------------------- Script to get browsing history of google chrome $UserName = "USERNAME" # Pre-check for PSSQLite try { if (-not (Get-Module -ListAvailable -Name PSSQLite)) { Write-Output "PSSQLite module is not installed. Please run: Install-Module -Name PSSQLite -Scope AllUsers -Force" exit } Import-Module PSSQLite -ErrorAction Stop } catch { Write-Output "Failed to import PSSQLite. Likely due to Execution Policy restrictions." Write-Output "Run: Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force" exit } # Standard path $chromeHistoryPath = "C:\\Users\\$UserName\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" # Store path $chromeStorePath = "C:\\Users\\$UserName\\AppData\\Local\\Packages\\GoogleChrome\_xxxxx\\LocalCache\\Local\\Google\\Chrome\\User Data\\Default\\History" # Pick whichever exists if (Test-Path $chromeHistoryPath) { $dbPath = $chromeHistoryPath } elseif (Test-Path $chromeStorePath) { $dbPath = $chromeStorePath } else { Write-Output "Chrome history not found for $UserName" exit } # Query history $tempPath = "$env:TEMP\\ChromeHistory.db" Copy-Item $dbPath $tempPath -Force $query = "SELECT url, datetime(last\_visit\_time/1000000-11644473600,'unixepoch') as visit\_time FROM urls ORDER BY last\_visit\_time DESC" $results = Invoke-SqliteQuery -DataSource $tempPath -Query $query foreach ($row in $results) { Write-Output "$UserName | Chrome | $($row.url) | $($row.visit\_time)" } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 $UserName = "USERNAME" \# Pre-check for PSSQLite try { if (-not (Get-Module -ListAvailable -Name PSSQLite)) { Write-Output "PSSQLite module is not installed. Please run: Install-Module -Name PSSQLite -Scope AllUsers -Force" exit } Import-Module PSSQLite -ErrorAction Stop } catch { Write-Output "Failed to import PSSQLite. Likely due to Execution Policy restrictions." Write-Output "Run: Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force" exit } \# Standard path $chromeHistoryPath = "C:\\Users\\$UserName\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" \# Store path $chromeStorePath = "C:\\Users\\$UserName\\AppData\\Local\\Packages\\GoogleChrome\_xxxxx\\LocalCache\\Local\\Google\\Chrome\\User Data\\Default\\History" \# Pick whichever exists if (Test-Path $chromeHistoryPath) { $dbPath = $chromeHistoryPath } elseif (Test-Path $chromeStorePath) { $dbPath = $chromeStorePath } else { Write-Output "Chrome history not found for $UserName" exit } \# Query history $tempPath = "$env:TEMP\\ChromeHistory.db" Copy-Item $dbPath $tempPath -Force $query = "SELECT url, datetime(last\_visit\_time/1000000-11644473600,'unixepoch') as visit\_time FROM urls ORDER BY last\_visit\_time DESC" $results = Invoke-SqliteQuery -DataSource $tempPath -Query $query foreach ($row in $results) { Write-Output "$UserName | Chrome | $($row.url) | $($row.visit\_time)" } ![Windows script to fetch browsing history of Google Chrome returns the output in the Action History tab of Hexnode.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2022/03/Windows-script-to-fetch-browsing-history-of-Google-Chrome-portal-output-300x149.png) Replace “USERNAME” with the username from which you would like to retrieve browsing history. PowerShell script to get the browsing history of Microsoft Edge --------------------------------------------------------------- PowerShell script to fetch the browsing history of Microsoft Edge $UserName = "USERNAME" # Pre-check for PSSQLite try { if (-not (Get-Module -ListAvailable -Name PSSQLite)) { Write-Output "PSSQLite module is not installed. Please run: Install-Module -Name PSSQLite -Scope AllUsers -Force" exit } Import-Module PSSQLite -ErrorAction Stop } catch { Write-Output "Failed to import PSSQLite. Likely due to Execution Policy restrictions." Write-Output "Run: Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force" exit } # Standard path $edgeHistoryPath = "C:\\Users\\$UserName\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\History" # Store path $edgeStorePath = "C:\\Users\\$UserName\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge\_xxxxx\\LocalCache\\Local\\Microsoft\\Edge\\User Data\\Default\\History" # Pick whichever exists if (Test-Path $edgeHistoryPath) { $dbPath = $edgeHistoryPath } elseif (Test-Path $edgeStorePath) { $dbPath = $edgeStorePath } else { Write-Output "Edge history not found for $UserName" exit } # Query history $tempPath = "$env:TEMP\\EdgeHistory.db" Copy-Item $dbPath $tempPath -Force $query = "SELECT url, datetime(last\_visit\_time/1000000-11644473600,'unixepoch') as visit\_time FROM urls ORDER BY last\_visit\_time DESC" $results = Invoke-SqliteQuery -DataSource $tempPath -Query $query foreach ($row in $results) { Write-Output "$UserName | Edge | $($row.url) | $($row.visit\_time)" } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 $UserName = "USERNAME" \# Pre-check for PSSQLite try { if (-not (Get-Module -ListAvailable -Name PSSQLite)) { Write-Output "PSSQLite module is not installed. Please run: Install-Module -Name PSSQLite -Scope AllUsers -Force" exit } Import-Module PSSQLite -ErrorAction Stop } catch { Write-Output "Failed to import PSSQLite. Likely due to Execution Policy restrictions." Write-Output "Run: Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force" exit } \# Standard path $edgeHistoryPath = "C:\\Users\\$UserName\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\History" \# Store path $edgeStorePath = "C:\\Users\\$UserName\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge\_xxxxx\\LocalCache\\Local\\Microsoft\\Edge\\User Data\\Default\\History" \# Pick whichever exists if (Test-Path $edgeHistoryPath) { $dbPath = $edgeHistoryPath } elseif (Test-Path $edgeStorePath) { $dbPath = $edgeStorePath } else { Write-Output "Edge history not found for $UserName" exit } \# Query history $tempPath = "$env:TEMP\\EdgeHistory.db" Copy-Item $dbPath $tempPath -Force $query = "SELECT url, datetime(last\_visit\_time/1000000-11644473600,'unixepoch') as visit\_time FROM urls ORDER BY last\_visit\_time DESC" $results = Invoke-SqliteQuery -DataSource $tempPath -Query $query foreach ($row in $results) { Write-Output "$UserName | Edge | $($row.url) | $($row.visit\_time)" } ![Windows script to fetch browsing history of Microsoft Edge returns the output in the Action History tab of Hexnode.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2022/03/Windows-script-to-fetch-browsing-history-of-Microsoft-Edge-portal-output-300x149.png) Replace “USERNAME” with the username from which you would like to retrieve browsing history. PowerShell script to get the browsing history of Firefox -------------------------------------------------------- PowerShell script to fetch the browsing history of Firefox $UserName = "USERNAME" # Pre-check for PSSQLite try { if (-not (Get-Module -ListAvailable -Name PSSQLite)) { Write-Output "PSSQLite module is not installed. Please run: Install-Module -Name PSSQLite -Scope AllUsers -Force" exit } Import-Module PSSQLite -ErrorAction Stop } catch { Write-Output "Failed to import PSSQLite. Likely due to Execution Policy restrictions." Write-Output "Run: Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force" exit } # Store version profile path $firefoxStorePath = "C:\\Users\\$UserName\\AppData\\Local\\Packages\\Mozilla.Firefox\_n80bbvh6b1yt2\\LocalCache\\Roaming\\Mozilla\\Firefox\\Profiles" if (Test-Path $firefoxStorePath) { $profile = Get-ChildItem $firefoxStorePath | Select-Object -First 1 $placesPath = "$($profile.FullName)\\places.sqlite" if (Test-Path $placesPath) { $tempPath = "$env:TEMP\\FirefoxHistory.db" Copy-Item $placesPath $tempPath -Force $query = "SELECT url, datetime(visit\_date/1000000,'unixepoch') as visit\_time FROM moz\_places JOIN moz\_historyvisits ON moz\_places.id = moz\_historyvisits.place\_id ORDER BY visit\_date DESC" $results = Invoke-SqliteQuery -DataSource $tempPath -Query $query foreach ($row in $results) { Write-Output "$UserName | $($row.url) | $($row.visit\_time)" } } else { Write-Output "Firefox history DB not found for $UserName" } } else { Write-Output "Firefox Store profile not found for $UserName" } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 $UserName = "USERNAME" \# Pre-check for PSSQLite try { if (-not (Get-Module -ListAvailable -Name PSSQLite)) { Write-Output "PSSQLite module is not installed. Please run: Install-Module -Name PSSQLite -Scope AllUsers -Force" exit } Import-Module PSSQLite -ErrorAction Stop } catch { Write-Output "Failed to import PSSQLite. Likely due to Execution Policy restrictions." Write-Output "Run: Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force" exit } \# Store version profile path $firefoxStorePath = "C:\\Users\\$UserName\\AppData\\Local\\Packages\\Mozilla.Firefox\_n80bbvh6b1yt2\\LocalCache\\Roaming\\Mozilla\\Firefox\\Profiles" if (Test-Path $firefoxStorePath) { $profile = Get-ChildItem $firefoxStorePath | Select-Object -First 1 $placesPath = "$($profile.FullName)\\places.sqlite" if (Test-Path $placesPath) { $tempPath = "$env:TEMP\\FirefoxHistory.db" Copy-Item $placesPath $tempPath -Force $query = "SELECT url, datetime(visit\_date/1000000,'unixepoch') as visit\_time FROM moz\_places JOIN moz\_historyvisits ON moz\_places.id = moz\_historyvisits.place\_id ORDER BY visit\_date DESC" $results = Invoke-SqliteQuery -DataSource $tempPath -Query $query foreach ($row in $results) { Write-Output "$UserName | $($row.url) | $($row.visit\_time)" } } else { Write-Output "Firefox history DB not found for $UserName" } } else { Write-Output "Firefox Store profile not found for $UserName" } ![Windows script to fetch browsing history of Firefox returns the output in the Action History tab of Hexnode.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2022/03/Windows-script-to-fetch-browsing-history-of-Firefox-portal-output-300x149.png) Replace “USERNAME” with the username from which you would like to retrieve browsing history. How to View Script Output in Hexnode ------------------------------------ To review the execution results, navigate to the **Action History** tab of the specific device in your Hexnode UEM portal. Locate the script entry in the **Subject** column and click the **Show Output** button next to the status field to view the returned data. Notes:- These scripts depend on the **PSSQLite** PowerShell module. Ensure that the module is installed on the device before running any of the scripts. - It is recommended to manually validate the script execution on a system before executing the action in bulk. - Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.