Filesystem and storage
NtfsDisableLastAccessUpdate
The last-access timestamp, and why Windows already manages it for you
Last updated
Should you disable NTFS last access timestamps?
NTFS can record when each file was last read, which means a write to the filesystem for what would otherwise be a read-only operation. Since Windows 10 version 1803 this has been System Managed by default, and Windows disables it automatically on volumes where it would cost more than it is worth. The tweak that used to matter is now largely done for you.
Registry location and values
NtfsDisableLastAccessUpdate
- Location
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem- Value name
NtfsDisableLastAccessUpdate- Type
REG_DWORD- Default
- 2 — System Managed, Last Access Updates Enabled
| Value | What it does |
|---|---|
0 (0x80000000) | User Managed, updates enabled. |
1 (0x80000001) | User Managed, updates disabled. |
2 (0x80000002) | System Managed, updates enabled. The default since Windows 10 1803. |
3 (0x80000003) | System Managed, updates disabled. |
What Windows actually does with this
Before 1803 this was a simple on/off flag. It now encodes two things: whether the system or the user controls the policy, and whether updates are on. Under System Managed, Windows decides per volume, and disables updates where the write cost outweighs the benefit.
What it affects
A small write amplification on read-heavy workloads. Also affects any tool that relies on last-access times: some backup software, some indexing, and forensic timelines.
Is it worth changing?
Barely worth touching on a modern install. The default is System Managed, which means Windows is already making this decision sensibly. The measurable benefit on an SSD is very small. Use `fsutil behavior query disablelastaccess` to see the current state before changing anything -- on many machines it is already effectively disabled and the tweak would be a no-op.
What can go wrong
Some backup and archiving tools use last-access time to decide what to process. Disabling updates can change their behaviour. Forensic and audit tooling loses a signal.
How to undo it
`fsutil behavior set disablelastaccess 2` to return to System Managed with updates enabled, then restart.
Create a System Restore Point before editing the registry. Every setting on this page is reversible, but a restore point is the difference between undoing one change and reinstalling Windows.
Which Windows versions this applies to
The four-value form applies to Windows 10 version 1803 and later, and Windows 11. Earlier versions use a simple 0/1.
NtfsDisableLastAccessUpdate: common questions
How do I check the current setting?
Run `fsutil behavior query disablelastaccess` in an elevated prompt. It reports both the mode and whether updates are enabled, which is more informative than reading the registry value.
Sources
Does JINSHI Tweaks change this?
This page documents a setting that corresponds to the following toggle in JINSHI PC Tweaks: Disable NTFS Last Access Timestamps.
The reference above is written to be usable without the product. Everything here can be applied by hand for free. What the application adds is that the change is applied in one pass, a System Restore Point is created first, and each toggle can be reversed individually.