Enable or Disable NTFS Last Access Time Stamp Updates in Windows 10  

STRESSED said:

Per your own article, 2 is supposed to equate to "System Managed, Last Access Time Updates Enabled". Instead, I'm seeing that it disables it.

Clearly, Microsoft changed something or messed it up at some point.

It is odd the about command is correct for what it's suppose to do, but I don't understand why the commands are not the same for you.

Did you test option 2 in the tutorial to see what it reports?

STRESSED said:

If I set "DisableLastAccess" to 0, the "NtfsDisableLastAccessUpdate" value in my registry is 80000000.

For 1, it's 80000001.
For 2, it's 80000002.
For 3, it's 80000003.

After testing each of those and setting it back to 0, I expected my last access stamps to continue being untouched when files were accessed--but no. Now they're being updated, even though I have not rebooted. But I'm still seeing what I was seeing before:

Restart after the change to see what it reports then.

STRESSED said:

Clearly, Microsoft changed something or messed it up at some point.

Windows 11 or Windows Insider forces this settings to be enabled. I disable it at shutdown, yet it is ON.

smirk24 said:

Does this setting disable all last access writes or just the user? 80000001 (hex) = User Managed, Last Access Time Updates Disabled

Im just trying to make sure all last access write are disabled is all. thank you for your help

(for windows 10)

Correct, using 1 should disable all last access.

Hi I am adding more to the confusion, it looks like 0 and 1, as well as 2 and 3 are reversed to the guide.

First of all my existing setting (I dont think I have touched this, its not in my OS install script).

Code:

fsutil behavior query disablelastaccess
DisableLastAccess = 3  (System Managed, Enabled)

Note it says 3 and is enabled. In the guide 2 is listed as the default.

Now when I run the set command without arguments, it spits out this.

Code:

fsutil behavior set disablelastaccess
Usage: fsutil behavior set disableLastAccess <0-3> 

Values: 0x0 - User Managed, Last Access Updates Enabled        
0x1 - User Managed, Last Access Updates Disabled         
0x2 - System Managed, Last Access Updates Enabled         
0x3 - System Managed, Last Access Updates Disabled

- When "System Managed" is enabled it allows the system to enable/disable   
last access time updates based on system policy. 
- If group policy is in effect or this registry key is uninitialized then   
the "System Managed" state can not be set and is not displayed.

The only thing I can conclude here is Microsoft have messed up on descriptions for the query command. I can confirm that currently with it set to 3, last access is not been updated.

So the enabled in the query output refers to whether the flag is enabled or not, not if last access is enabled or not. so 0 and 2 means last access updates are enabled not disabled. The only unknown left is why my system is not on the defaults, however system managed can be changed automatically on boot, so I guess something on boot on my system is deciding to set to 3 instead of 2.

Hello @Chrysalis,

I just tested on my system to see what it's showing now, but it's still the same as in the tutorial for me.

STRESSED said:

I ran "fsutil behavior set disablelastaccess 1" and rebooted. But now, when I run "fsutil behavior query disablelastaccess", I still get "DisableLastAccess = 1 (User Managed, Enabled)".

After I run "fsutil behavior set disablelastaccess 0", I get "DisableLastAccess = 0 (User Managed, Disabled)".

What could be going on here? I don't know whether to trust the 0 / 1 or the "Enabled / Disabled".

That output is correct.

DisableLastAccess = 1 (User Managed, Enabled) = "Last Access Time Stamp" is disabled.

(User Managed, Enabled) means DisableLastAccess is enabled.
That output is only for that command, not for status of timestamp.

Conclusion: "Last Access Time Stamp" is disabled only if DisableLastAccess is enabled.