In Windows, you can disable the last accessed timestamp by setting NtfsDisableLastAccessUpdate to 1, for instance by executing this from the command line (the computer must be restarted before it takes effect):

fsutil behavior set disablelastaccess 1

I want to do so there is less disk activity on c:\$logfile.

Might this cause any negative effects or problems?


You wouldn't be able to tell if someone else was reading your files - for example if you had some sensitive data.

I can't think of an OS level command that would need last accessed. Backups check last modified and date created for example. But see @mythokia's answer for one case that might.

Given that it's disabled by default in Windows 7 (thanks @AndrejaKo) and Vista that indicates that (unless there are other changes to compensate) it's OK to turn it off.

I've just thought of a reason why it might be disabled in the new OSes. These have the new Windows Search installed by default. This scans the selected directories for changes and re-indexes new and changed files. This would have written lots of events to the log which might be a reason for disabling it. There's more information on why they stopped updating the Last Access time from Vista onwards in MSDN blog post Why doesn't the file system have a function that tells you the number of files in a directory?.

  • 2
    I'm on fresh installation of windows 7 64bit here and NtfsDisableLastAccessUpdate is set to 1 by default. – AndrejaKo Oct 16 '10 at 16:30
  • The Search indexer doesn't constantly scan for changes, it uses the NTFS change journal. Otherwise an excellent answer. – afrazier Oct 16 '10 at 19:44
  • @afrazier - removed the "continually" – ChrisF Oct 16 '10 at 20:01
  • 3
    You probably should disable it on SSD. – maaartinus Apr 24 '11 at 16:39
  • You wouldn't be able to tell if someone else was reading your files You can’t anyway; in my experience the timestamp is touched from almost every activity, including viewing a directory listing (at least in Windows; dir on a FAT32 volume in DOS does not update it). This renders the attribute effectively useless since it will always report just right now for everything, unless perhaps if you are viewing it “offline” (e.g., through a hex-editor instead of mounted in Windows). – Synetech Aug 19 '13 at 20:39

Some defragmentation programs do use last access as one of the variables of their algorithms. An example would be O&O Defrag.

  • Oh yes - put most recently used files where they're quickest to access. Good point. – ChrisF Oct 16 '10 at 17:17

Don't know about negative effects, but some of these answers are just plain wrong (namely, ChrisF's and Synetech's).


  1. my desktop's desktop.ini file, for instance, has different timestamps for all entries (created, modified and accessed), while other files in the same folder have either the same timestamps for all entries, or just for 2 entries (e.g.: same created and accessed timestamps, different modified timestamp (typically, dl'ed files));
  2. performing a dir command on my desktop folder doesn't change any timestamp;


  1. in (my) Windows 7 (x64 sp1), last access timestamp is not disabled;
  2. dir does not touch timestamps on NTFS, either;
  • 1
    All you have to do is run regedit.exe, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem and look at the value of NtfsDisableLastAccessUpdate to actually verify. Meanwhile, same created and accessed timestamps suggests that is indeed disabled. – George Marian Aug 8 '15 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.