Enable or Disable NTFS Last Access Time Stamp Updates in Windows 10  

Paul Black said:

Hello @Brink ,

Good idea. I have amended the code above accordingly.

Great. If you can post some screenshots for it, I'll get it added to the tut.

Brink said:

Great. If you can post some screenshots for it, I'll get it added to the tut.

Thank you @Paul Black.

Now added as option 3.

Enable or Disable NTFS Last Access Time Stamp Updates in Windows 10

Brink said:

Thank you @Paul Black.

Now added as option 3.

Enable or Disable NTFS Last Access Time Stamp Updates in Windows 10

You are VERY welcome.

STRESSED said:

I ran "fsutil behavior set disablelastaccess 1" and rebooted. But now, when I run "fsutil behavior query disablelastaccess", I still get "DisableLastAccess = 1 (User Managed, Enabled)".

After I run "fsutil behavior set disablelastaccess 0", I get "DisableLastAccess = 0 (User Managed, Disabled)".

What could be going on here? I don't know whether to trust the 0 / 1 or the "Enabled / Disabled".

Hello,

Just to verify, did you restart the computer after running the command to apply?

Yes, I did reboot. When I run "fsutil behavior set disablelastaccess /?" it comes back with:

Usage: fsutil behavior set disableLastAccess <0-3>

Values: 0x0 - User Managed, Last Access Updates Enabled
0x1 - User Managed, Last Access Updates Disabled
0x2 - System Managed, Last Access Updates Enabled
0x3 - System Managed, Last Access Updates Disabled

- When "System Managed" is enabled it allows the system to enable/disable last access time updates based on system policy.
- If group policy is in effect or this registry key is uninitialized then the "System Managed" state can not be set and is not displayed.

But when I run "fsutil behavior query disablelastaccess", I still get:

DisableLastAccess = 0 (User Managed, Disabled)

0 is supposed to be "User Managed / Enabled" and 1 is supposed to be "User Managed / Disabled", and yet I'm showing a mix of the two.

My last access date/time stamps are not being updated when I open files, so I guess 0 is the way to disable it--on 20H2, at least.

STRESSED said:

Yes, I did reboot. When I run "fsutil behavior set disablelastaccess /?" it comes back with:

But when I run "fsutil behavior query disablelastaccess", I still get:

0 is supposed to be "User Managed / Enabled" and 1 is supposed to be "User Managed / Disabled", and yet I'm showing a mix of the two.

My last access date/time stamps are not being updated when I open files, so I guess 0 is the way to disable it--on 20H2, at least.

Odd. What does it report if you use option 2 instead to directly change the registry value for it?

STRESSED said:

When I run "fsutil behavior set disablelastaccess 2" I get "DisableLastAccess = 2 (System Managed, Disabled)".

At least that is correct and disables it.