SEARCH

How-To Geek

Speed Up Disk Access by Disabling Last Access Updating in Windows XP

Did you know that Windows XP updates files with the last access update time when they are opened by any application? Seems to me that it’s not entirely useful, so let’s go through how to disable it.

Note that this tweak is not necessary for Windows Vista because it’s already set as the default, even if you upgrade from XP to Vista.

image 

Manual Registry Tweak

Open up regedit.exe through the start menu run box, and then navigate down to the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

image

Create a new DWORD value in the right-hand pane named NtfsDisableLastAccessUpdate and give it a value of 1. To remove this tweak just delete the key or give it a value of 0.

You’ll have to restart your computer before it will take effect.

Download Registry Tweak

Download and extract the file and double-click on the DisableLastAccessUpdate.reg file to enter the information into the registry. There’s also a removal script included.

Download DisableLastAccessUpdate Registry Tweak

Lowell Heddings, better known online as the How-To Geek, spends all his free time bringing you fresh geekery on a daily basis. You can follow him on if you'd like.

  • Published 02/5/08

Comments (36)

  1. Barron

    How much of a performance increase are we talking about here? Every little bit counts, but I’m wondering how much to expect.

  2. Anthony Lawrence

    It’s actually very useful in troubleshooting.

    My http://aplawrence.com/Unixart/troubleshooting.html talks about this in the context of a Unix environment, but it’s no different in Windows: last access date is valuable forensic evidence when you are trying to find out why something unpleasant is happening on your system.

    As I said at that referenced link:

    Needing or wanting to know when something was last accessed comes up all the time, but just a few examples might give you some ideas:

    A directory was supposed to be on the backup but isn’t. Did the backup program access that directory?

    A misbehaving program is supposed to use a certain file during its startup. Did it?

    What files does a program try to use? Knowing this can sometimes help you track down where a program is failing when it is too dumb to tell you itself.

  3. Ray

    I have to disagree that it’s not useful and the time it takes to write that info is negligible to affect disk access.

    As an IT consultant, I find that the last accessed info is important in detecting malware and other programs that like to hide themselves. Unless the malware or trojan writer is really writing his destructive software with a lot of detail, they will skip making the last access date some off the wall number. I have seen it, but only once or twice.

    Before going here, I’d look to what is loading at startup and what is staying in memory after a program is closed. An in depth look at all programs loading and unloading would better serve the speed issue of a system than a nanosecond write to the HD. It is an interesting thought though.

  4. The Geek

    I had a feeling this would be controversial =)

    The most interesting thing here is that Microsoft chose to make this the default setting in Vista… obviously they must have done some testing and figured out that it makes sense. The same tweak is also very popular for Linux as well.

    If you think about it, it does make sense… when you consider caching on the hard drive and file buffers in the operating system, many applications should be able to read pretty much solely from memory, not requiring any writes back to the hard drive unless you save data.

    If you want to monitor when a file is accessed, you should check out Process Monitor, which will let you see every single read/write operation a particular application is doing.

  5. Anthony Lawrence

    Well there you go: if Microsoft did it, it must make sense.

    Yeah.. I think you’ve been drinking the Kool-Aid :-)

  6. Ray

    I use all the Sysinternals tools, but you can’t have Process Monitor running for a long period of time because the capture file, even with filters, will bog the system down. Plus, any real malware infection slows the computer to a crawl that would make using it in real mode impractical. There is no need to use it in Safe Mode, since the malware doesn’t load.

  7. The Geek

    Kool-Aid? I’ve been drinking mountain dew =)

    For many years there have been various tweaks to the registry that Microsoft never added into Windows… the kernel paging one, io lock limit, etc… Many people swore by them but they never showed up in the next version of Windows. One could only assume that they had done testing of those settings and didn’t find them to increase performance for most people. That’s why I was surprised when I found out this tweak had been added into Vista, and figured they must have had a basis for doing so.

    Definitely can’t have process monitor running for a long period of time… but I don’t think geeks like us are going to be infected with spyware in the first place.

    Finally, if you are running anti-spyware and/or anti-virus this tweak will be meaningless since your disk access is already slowed down by a few hundred percent anyway.

  8. Anthony Lawrence

    As I said originally, it’s not just for spyware. It’s a useful troubleshooting tool.

    And of course there are other tools available – but sometimes I can’t download them (corporate policy, no ijnternet, no cd, etc.) and sometimes I don’t want to because changing the system can trample evidence that is already there.

  9. Ray

    Of course I’m not using Process Monitor on my system, nor as you say do us geeks have spyware infections. I’m talking about using it in the field on clients computers.

    As an example I did 2 spyware/virus clean ups on Friday/Saturday in which both systems took an average of 15 minutes to boot and 15 to 30 to respond to any commands. Both ended up being a total of 6.5 billable hours of waiting, rebooting to safe mode, cleaning etc. I found the nasties, but could not have used anything except Process Explorer to suspend tasks so that I could install the virus and antispyware tools.

    Thanks for the discussion….

  10. MJ

    Seems to make sense to me. I like to squeeze every cent of performance out of my machine as possible.

  11. dcj2

    Interesting tweak, but I can’t agree with your “They did it in Vista so it must be good for XP, too” justification. Remember that Vista was originally designed to have a significantly different file system architecture than the Vista that MS is currently shipping. NTFS stores last access date as an attribute of the file, but the new file system was to be one honkin’-big SQL database. The Last Access date would then become a property of the record within the database, so there would be no need to store it as a file system attribute. In essence, all you data access would share the same last-access date, because they’d all be in the database file. Bottom line for me: any performance increase this tweak might provide would be insignificant compared to the value of the file info you’d lose. Just because you *can* turn it off in XP doesn’t mean you should.

  12. Gary

    In my experience with the last access date is seems to get updated for the most trivial of tasks. For instance, if you check the Properties of a file it will update the date. Technically this might be an access but IMO it shouldn’t result in updating the date.

  13. The Geek

    @Anthony and Ray

    I agree with you both… these types of tweaks are not good for machines owned by regular users, and it probably would be good for troubleshooting purposes on their machines.

    I always worry about recommending the wrong thing for the wrong users, but I usually err on the side of information being free. Perhaps I should put up some disclaimers?

    Personally I don’t even use antivirus or anti-anything on my machines, because I don’t download anything via Vista (I use my linux box for downloading, and scan certain files with clamwin before using them) I’d never recommend that for regular users, of course.

  14. The Geek

    On another note, these discussions are great fun, I really enjoy the feedback from all the readers!

  15. dcj2

    To Gary – I think Last Access works as it should: a read, even to check file size, counts as an access. What you’re probably more concerned with is the Last Modified Date, which is also stored.

  16. jd2066

    That is an interesting change with Vista.
    It appears though that while that registry key is set that something in Windows still does set the last access time.
    If I select a file in Windows Explorer and look the accessed property the date and time is just a few seconds before I opened the dialog.
    The really odd thing though is that dialog would change the last access at all. If it’s changed when you go to look at when when it’s changed then the purpose is defeated.

  17. The Geek

    @jd2066

    I’ve noticed similar weirdness while researching this one… it seemed like sometimes it would update and sometimes it wouldn’t, even while set to the default in XP. It really doesn’t make any sense… but then a lot of stuff in Windows doesn’t make any sense.

    I really appreciate your research and fact checking on the articles. Perhaps if I get more organized down the road I’ll start giving you a preview of the articles ahead of time =)

  18. PMB

    I tured it on. If you’re compiling 1k, 10k, or 100k source-files applications on any regular basis, cutting down on a few thousand writes to disk sounds like a good idea.

  19. Jesse

    I would like to do this for privacy reasons, unfortunately I am very computer illiterate… how do I find the registry editor, I tried copy pasting the thing above and it didn’t work.

  20. jd2066

    @Jesse: You can use the download link above. It’s a zip file that contains a registry file to apply the change.

  21. Hoop

    I’ve got a file accessed question for someone. We have Windows XP at work and I believe that someone has an illegal Administrator account or access. A very critical Excel file was deleted from from user account. I last accessed the file on Sunday and discovered it was missing on Wednesday. I wasn’t at work on Monday or Tuesday but he was. So Wednesday I started looking at the file access times for other files (15 files) and all but one showed the present time when I right clicked the file and hit properties. The one oddball file showed it was last accessed on Tuesday afternoon. Could this just be a Windows glitch? I also did some testing and noticed that the access file time will refresh after exactly one hour. Meaning if I right click/properties at 7am then do the same thing at 7:59am it will still show last accessed at 7am but once it’s 8am it’ll show 8am as last accessed if you right click it again.

    It’s too bad Windows doesn’t show the last opened or viewed time. Also if anyone has any input as to how someone can go undetected (IT dept doesn’t know) when using an Administrtor account I’d like to know.

    I enjoy the website and thanks.

  22. jesse

    I actually am having the same problem, I think there is someone going into my files while I am away and I want to make sure that I’m right before accusing someone, but as of last week when I go to check the times certain files were last accessed they all show the time my computer seems to have come out of hibernation. even files I know I haven’t accessed in days. I tried the link above but nothing happened. I’m not sure what to do anymore.

  23. jd2066

    @Hoop: It can go undetected if the computers don’t have logging turned on and/or the person got access to someones password. You can tell Windows to log all file accesses and it would list the user that accessed the file. It wouldn’t help though if someone did get the password to the Administrator account. If it was an existing account that someone got access too then that may mean the password was easy to guess or the account’s password got leaked to the person somehow.

    @All:
    On the files accesses I would say sometimes Windows just does odd things. I’ve looked in File Monitors on my computer where I know there aren’t any security problems and various Windows processes just seem to go around reading seeming random files for no reason.
    I’ve seen files in the list I haven’t touched for years but Windows seems to think it should check it out.

  24. Hoop

    @jd2066: Thanks for the reply. My IT dept confiscated the computer and will check everything out. Unfortunately, I think this guy may try to stay one step ahead of them but hopefully they’ll catch him eventually. I think that one file access time was probably a glitch. Thanks again!

  25. jesse

    @jd2066: But would windows do this the same way every time. It’s been 2 weeks, and everytime I try, my files are accessed at the time the computer comes out of hibernation. just file folders, not documents. It just seems to be to much of a coincidence.
    Thank you

  26. jesse

    I have found something interesting, in computer management, under event viewer, it shows that the other computer my computer is networked to logs on and off every 32 minutes. Is it possible the other user can access my computer through the network without me knowing? if so what are the signs of this and how do I stop it?

  27. PL

    I am having a strange occurance. Bear with me as I try to explain. I want to remove any stale reports that are on a server NTFS share. So I want to use the last access date attribute. However I notice ALL files have the same lastaccess date. Example the attribute shows all files have last access date of 3/22/2005 8:45am. I am unable to find what is causing this lastaccess date. I use symantec antivirus corp edition but I have excluded that folder with these reports from the scan. Then I thought it was the backup agent from HP’s dataprotector. But the back up doesn’t run at that time. I do not most of these files are being access and to boot at the same exact time.

  28. Vladimir

    And last access time could be great feature if someone wants to defrag drive with clever defrag program or wants to order files in some very old archive.

  29. Vladimir

    But unfortunately some antivirus programs change this attribute (((

  30. Mathew

    Indeed. Last access is a valuable forensic measurement.

    But I like that it is useful for defragging purposes, files that have not been accessed for a long time could be compressed(with NTFS transparent compression) and defraggers could move it to some area on the hard disk.

    I do not think the last access time is updated if you just listed the directory, but windows might access the file(open for reading) when its displayed in windows explorer. For example, in thumbnail previews, or if you selected some extra columns(id3 tags for mp3s, other tags for photos, etc.) in windows explorer. You get the idea

    I’m not sure about antivirus though,it would be best if antivirus programs do preserve the last access time.

    As for performance issues, updating the last access time shouldn’t cause too much of a noticeable performance decrease. Since the time is trivial(probably just a few bytes), doesn’t take a megabyte or two to update. Moreover, windows uses disk caching, it could be the case that windows only writes to the disk when the disk cache is reasonably full.

  31. Pro4Life

    @Hoop Last Access Time works like this. For obvious reason Windows will not update the date any time when you open your file but in exactly 1 hour delay. This means that if you open your file in 1.00 PM It will NOT change that value until 2.00PM. It’s default in Windows and I think that time can’t be changed. Looking back into that idea seems good so your hard drive will not go crazy if you open one file too many times in close time frame.

  32. Max

    Most likely Microsoft chose to make this the default setting in Vista not to improve speed but to make Vista more SSD friendly. Indeed, it looks like a huge waste of the very limited write-cycle resource of today’s SSDs.

  33. Ralph

    “Indeed, it looks like a huge waste of the very limited write-cycle resource of today’s SSDs.”

    True. And benefit of the performance can be largely felt if you need to access many files at once, like in av-scan.

    Those guys earlier claiming that it is useful are pretty wrong in that there are tools which can tell you everything last access date may and MUCH more without needing to read it. It’s called Procmon and it not only can tell you WHEN was the file modified, it can also tell you WHICH PROGRAM did it and WHAT it did specifically
    (read, wrote, etc). Also backup programs IMO should NOT rely on last access date but on MODIFIED date instead, since what’s the point backing up exactly the same file OVER and OVER?

  34. Hbasm

    I would like to disable the last-access tracking for a particular (SSD) drive in Windows XP. How can I do that? (Since I have found no way of write protecting the drive).

  35. wikus

    My disk read rate is extreamly slow (274 according to the diskspeed utility compared to 18 330 average for comparable systems) Where can I start looking to improve?

  36. Joe

    I realize this is an old thread, but I wanted to comment.

    Why would you spend hours and hours cleaning up malware and a possible virus? Unless these guys were using 10+ software packages it had to have been easier and more effective to just back their files up with a Windows PE disk and then reload the systems.

Enter Your Email Here to Get Access for Free:

Go check your email!