Speed Up Disk Access by Disabling Last Access Updating in Windows XP
Did you know that Windows XP updates files with the last access update time when they are opened by any application? Seems to me that it's not entirely useful, so let's go through how to disable it.
Note that this tweak is not necessary for Windows Vista because it's already set as the default, even if you upgrade from XP to Vista.
Manual Registry Tweak
Open up regedit.exe through the start menu run box, and then navigate down to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
Create a new DWORD value in the right-hand pane named NtfsDisableLastAccessUpdate and give it a value of 1. To remove this tweak just delete the key or give it a value of 0.
You'll have to restart your computer before it will take effect.
Download Registry Tweak
Download and extract the file and double-click on the DisableLastAccessUpdate.reg file to enter the information into the registry. There's also a removal script included.
How much of a performance increase are we talking about here? Every little bit counts, but I'm wondering how much to expect.
It's actually very useful in troubleshooting.
My http://aplawrence.com/Unixart/troubleshooting.html talks about this in the context of a Unix environment, but it's no different in Windows: last access date is valuable forensic evidence when you are trying to find out why something unpleasant is happening on your system.
As I said at that referenced link:
Needing or wanting to know when something was last accessed comes up all the time, but just a few examples might give you some ideas:
A directory was supposed to be on the backup but isn't. Did the backup program access that directory?
A misbehaving program is supposed to use a certain file during its startup. Did it?
What files does a program try to use? Knowing this can sometimes help you track down where a program is failing when it is too dumb to tell you itself.
I have to disagree that it's not useful and the time it takes to write that info is negligible to affect disk access.
As an IT consultant, I find that the last accessed info is important in detecting malware and other programs that like to hide themselves. Unless the malware or trojan writer is really writing his destructive software with a lot of detail, they will skip making the last access date some off the wall number. I have seen it, but only once or twice.
Before going here, I'd look to what is loading at startup and what is staying in memory after a program is closed. An in depth look at all programs loading and unloading would better serve the speed issue of a system than a nanosecond write to the HD. It is an interesting thought though.
I had a feeling this would be controversial =)
The most interesting thing here is that Microsoft chose to make this the default setting in Vista… obviously they must have done some testing and figured out that it makes sense. The same tweak is also very popular for Linux as well.
If you think about it, it does make sense… when you consider caching on the hard drive and file buffers in the operating system, many applications should be able to read pretty much solely from memory, not requiring any writes back to the hard drive unless you save data.
If you want to monitor when a file is accessed, you should check out Process Monitor, which will let you see every single read/write operation a particular application is doing.
Well there you go: if Microsoft did it, it must make sense.
Yeah.. I think you've been drinking the Kool-Aid
I use all the Sysinternals tools, but you can't have Process Monitor running for a long period of time because the capture file, even with filters, will bog the system down. Plus, any real malware infection slows the computer to a crawl that would make using it in real mode impractical. There is no need to use it in Safe Mode, since the malware doesn't load.
Kool-Aid? I've been drinking mountain dew =)
For many years there have been various tweaks to the registry that Microsoft never added into Windows… the kernel paging one, io lock limit, etc… Many people swore by them but they never showed up in the next version of Windows. One could only assume that they had done testing of those settings and didn't find them to increase performance for most people. That's why I was surprised when I found out this tweak had been added into Vista, and figured they must have had a basis for doing so.
Definitely can't have process monitor running for a long period of time… but I don't think geeks like us are going to be infected with spyware in the first place.
Finally, if you are running anti-spyware and/or anti-virus this tweak will be meaningless since your disk access is already slowed down by a few hundred percent anyway.
As I said originally, it's not just for spyware. It's a useful troubleshooting tool.
And of course there are other tools available - but sometimes I can't download them (corporate policy, no ijnternet, no cd, etc.) and sometimes I don't want to because changing the system can trample evidence that is already there.
Of course I'm not using Process Monitor on my system, nor as you say do us geeks have spyware infections. I'm talking about using it in the field on clients computers.
As an example I did 2 spyware/virus clean ups on Friday/Saturday in which both systems took an average of 15 minutes to boot and 15 to 30 to respond to any commands. Both ended up being a total of 6.5 billable hours of waiting, rebooting to safe mode, cleaning etc. I found the nasties, but could not have used anything except Process Explorer to suspend tasks so that I could install the virus and antispyware tools.
Thanks for the discussion….
Seems to make sense to me. I like to squeeze every cent of performance out of my machine as possible.
Interesting tweak, but I can't agree with your "They did it in Vista so it must be good for XP, too" justification. Remember that Vista was originally designed to have a significantly different file system architecture than the Vista that MS is currently shipping. NTFS stores last access date as an attribute of the file, but the new file system was to be one honkin'-big SQL database. The Last Access date would then become a property of the record within the database, so there would be no need to store it as a file system attribute. In essence, all you data access would share the same last-access date, because they'd all be in the database file. Bottom line for me: any performance increase this tweak might provide would be insignificant compared to the value of the file info you'd lose. Just because you *can* turn it off in XP doesn't mean you should.
In my experience with the last access date is seems to get updated for the most trivial of tasks. For instance, if you check the Properties of a file it will update the date. Technically this might be an access but IMO it shouldn't result in updating the date.
@Anthony and Ray
I agree with you both… these types of tweaks are not good for machines owned by regular users, and it probably would be good for troubleshooting purposes on their machines.
I always worry about recommending the wrong thing for the wrong users, but I usually err on the side of information being free. Perhaps I should put up some disclaimers?
Personally I don't even use antivirus or anti-anything on my machines, because I don't download anything via Vista (I use my linux box for downloading, and scan certain files with clamwin before using them) I'd never recommend that for regular users, of course.
On another note, these discussions are great fun, I really enjoy the feedback from all the readers!
To Gary - I think Last Access works as it should: a read, even to check file size, counts as an access. What you're probably more concerned with is the Last Modified Date, which is also stored.
That is an interesting change with Vista.
It appears though that while that registry key is set that something in Windows still does set the last access time.
If I select a file in Windows Explorer and look the accessed property the date and time is just a few seconds before I opened the dialog.
The really odd thing though is that dialog would change the last access at all. If it's changed when you go to look at when when it's changed then the purpose is defeated.
@jd2066
I've noticed similar weirdness while researching this one… it seemed like sometimes it would update and sometimes it wouldn't, even while set to the default in XP. It really doesn't make any sense… but then a lot of stuff in Windows doesn't make any sense.
I really appreciate your research and fact checking on the articles. Perhaps if I get more organized down the road I'll start giving you a preview of the articles ahead of time =)
I tured it on. If you're compiling 1k, 10k, or 100k source-files applications on any regular basis, cutting down on a few thousand writes to disk sounds like a good idea.
I would like to do this for privacy reasons, unfortunately I am very computer illiterate… how do I find the registry editor, I tried copy pasting the thing above and it didn't work.
@Jesse: You can use the download link above. It's a zip file that contains a registry file to apply the change.
I've got a file accessed question for someone. We have Windows XP at work and I believe that someone has an illegal Administrator account or access. A very critical Excel file was deleted from from user account. I last accessed the file on Sunday and discovered it was missing on Wednesday. I wasn't at work on Monday or Tuesday but he was. So Wednesday I started looking at the file access times for other files (15 files) and all but one showed the present time when I right clicked the file and hit properties. The one oddball file showed it was last accessed on Tuesday afternoon. Could this just be a Windows glitch? I also did some testing and noticed that the access file time will refresh after exactly one hour. Meaning if I right click/properties at 7am then do the same thing at 7:59am it will still show last accessed at 7am but once it's 8am it'll show 8am as last accessed if you right click it again.
It's too bad Windows doesn't show the last opened or viewed time. Also if anyone has any input as to how someone can go undetected (IT dept doesn't know) when using an Administrtor account I'd like to know.
I enjoy the website and thanks.
I actually am having the same problem, I think there is someone going into my files while I am away and I want to make sure that I'm right before accusing someone, but as of last week when I go to check the times certain files were last accessed they all show the time my computer seems to have come out of hibernation. even files I know I haven't accessed in days. I tried the link above but nothing happened. I'm not sure what to do anymore.
@Hoop: It can go undetected if the computers don't have logging turned on and/or the person got access to someones password. You can tell Windows to log all file accesses and it would list the user that accessed the file. It wouldn't help though if someone did get the password to the Administrator account. If it was an existing account that someone got access too then that may mean the password was easy to guess or the account's password got leaked to the person somehow.
@All:
On the files accesses I would say sometimes Windows just does odd things. I've looked in File Monitors on my computer where I know there aren't any security problems and various Windows processes just seem to go around reading seeming random files for no reason.
I've seen files in the list I haven't touched for years but Windows seems to think it should check it out.
@jd2066: Thanks for the reply. My IT dept confiscated the computer and will check everything out. Unfortunately, I think this guy may try to stay one step ahead of them but hopefully they'll catch him eventually. I think that one file access time was probably a glitch. Thanks again!
@jd2066: But would windows do this the same way every time. It's been 2 weeks, and everytime I try, my files are accessed at the time the computer comes out of hibernation. just file folders, not documents. It just seems to be to much of a coincidence.
Thank you
I have found something interesting, in computer management, under event viewer, it shows that the other computer my computer is networked to logs on and off every 32 minutes. Is it possible the other user can access my computer through the network without me knowing? if so what are the signs of this and how do I stop it?
I am having a strange occurance. Bear with me as I try to explain. I want to remove any stale reports that are on a server NTFS share. So I want to use the last access date attribute. However I notice ALL files have the same lastaccess date. Example the attribute shows all files have last access date of 3/22/2005 8:45am. I am unable to find what is causing this lastaccess date. I use symantec antivirus corp edition but I have excluded that folder with these reports from the scan. Then I thought it was the backup agent from HP's dataprotector. But the back up doesn't run at that time. I do not most of these files are being access and to boot at the same exact time.