File Last Accessed

If you right click on any file, you can see the File Last Accessed value under the General tab. The problem is, that might not be up to date or might even report the 1st of January 1970 as last access date, even when you open and close the file.


Now that isn’t a great start if you want to audit files not accessed in a long time frame. That would be extremely helpful for File Servers as you would be able to provide reports to the Share’s owners. This will help them choosing the files that can be archived/deleted.

The reason why this is not updating by default is due NtfsDisableLastAccessUpdate [HKLM\SYSTEM\CurrentControlSet\Control\FileSystem] registry key that is set to 1 to prevent excessive writes to disk. This is Microsoft’s description about this REG_DWORD:
0: When listing directories, NTFS updates the last-access timestamp on each directory it detects, and it records each time change in the NTFS log.
1: When listing directories, NTFS does not update the last-access timestamp, and it does not record time stamp updates in the NTFS log.

Setting this key to 0 will allow the OS to start capturing the last accessed property. Another way to disable this registry key is running the following command with elevated rights:

In Microsoft’s words: Because updating the last-accessed timestamp requires writing data to the disk, an activity that accesses many files might be faster if this type of update is disabled.
I searched a bit more and also found out a user who noticed a 6% performance increase when this key was set to 1. When NtfsDisableLastAccessUpdate was set to 1, the backup took 5 hours and 45 minutes, when it was set to 0 it took 6 hours and 7 minutes (200GB worth of data).

4 thoughts on “File Last Accessed

  1. fsutil behavior set DisableLastAccess 0 on server 2016 seems to have no effect. I set it then rebooted and its still not changing the accessed timestamp when I open the file without saving.
    Has there been a change in 2016 to break it or am I making a mistake?

    1. Hi Rob, thanks for reporting this. I do not have a test system with me to quickly test this, however, can you check if it works by setting it via the registry key?
      It should, I found a MS article that describe this and include Windows Server 2016, so the Registry should definitely work:
      The system-global switch NtfsDisableLastAccessUpdate (REG_DWORD) 1 is located under HKLM\System\CurrentControlSet\Control\FileSystem and is set by default to 1. This switch reduces disk I/O load and latencies by disabling date and time stamp updating for the last file or directory access. Clean installations of Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, and Windows Server 2008 enable this setting by default, and you do not need to adjust it. Earlier versions of Windows did not set this key. If your server is running an earlier version of Windows, or it was upgraded to Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008, you should enable this setting.
      Here’s the link:

  2. Hi Simone –

    Nice Article. 🙂

    Your comment at the end, on performance impact: The user you found who tried backups with this on or off and saw 6% difference depending on the switch? The fact he backed up 200GB is somewhat (not totally, but somewhat) irrelevant if we don’t know the # of files backed up too. This is because the performance impact is affected the same for each file – so my performance could vary wildly if i have 10 20GB files vs 10,000 20MB files. Both end up being 200GB, but I bet writing last-access timestamp to 10 files is much faster than writing it to 10,000.

    So – any idea on the # of files they backed up?

    thanks… 🙂

    1. Hi Brian,
      Nope, no idea on the amount of files, but of course, what you’re saying is correct. It doesn’t really matter the size, the quantity is what matters. The more files you have the more it’ll take to go through and set this flag.

Leave a Reply

Your email address will not be published. Required fields are marked *