How to Enable Last Access Time Stamp To Files on Windows


To save system resources in Vista, Microsoft disabled the Last Access Time Stamp. With Windows 7, this timestamp remains disabled. Windows 7 isn’t the system hog than Vista is. So I think it’s time we turn the ‘last access time stamp’ back on. Especially since most of you probably never knew it was disabled in the first place.

This trick can be useful if you think someone or something (malware) other than you might be using your computer. Or perhaps you’re a forensics corp IT guy? Anyway, a few things to keep in mind before we get started:

1) Enabling or Disabling this won’t make your Accessed date vanish or reappear, rather it will only change if Windows updates the timestamp or not.

2) If a last accessed timestamp already exists for your file, it will remain persistent unless this feature is enabled. Once enabled, however, all of your apps will become aware of when they are being used/accessed.

Windows 7 screenshot - date accessed not being updated very well

How to Add Access Time Stamps to All Files on Windows 7

1. Click Start and then search for cmd. Once that comes up right-click cmd.exe and select Run as administrator.

Windows 7 screenshot -run cmd as an administrator

2. When the UAC prompt appears click Yes.

Windows 7 screenshot -go through cmd admin uac

3. Now in the cmd prompt, Type in “ fsutil behavior set disablelastaccess 0 “ and press Enter.

Windows 7 screenshot -using the command prompt line to turn on text with iPad or iPod touch

4. Restart your PC for changes to take effect.

Now timestamps are enabled, and you’ll be able to see when files are accessed from now on. Take note on really old PCs this might cause performance issues, but even that isn’t too common.

Okay, now we’ll look at the other side. Maybe you have Time Stamps enabled, but you are ready to give them the boot.

How To Disable Last Access Time Stamps In Windows 7

Open the cmd prompt from administrator mode like before, but this time type in “ fsutil behavior set disablelastaccess 1

Windows 7 screenshot -how to disable the setting

How To Use Last Access Time Stamps In Windows Search Results

Windows 7 screenshot -Windows Search

Manually looking through the properties of every file on your system could take years.  This scenario is where Windows Search comes into use. Using Search + Timestamps you’ll be able to sort by access date and see exactly what went down on your PC, exactly when it all happened, and sometimes even in what order.

1. In the Start Menu search area, Type * and press Enter.

Searching for a * sign signifies that Windows Search should pull up every single file on your computer.  The ‘See more results’ button is another great way to get into the searching mood.

Windows 7 screenshot - see more results

2. Switch the Window view to Details.

Windows 7 screenshot -view details of file searches

3. Right-click the category bar and click More.

Windows 7 screenshot -click the more button

4. On the next window scroll down and check the box for Date Accessed and then hit OK.

Windows 7 screenshot -check a checkbook in the balance for Apple to get me to pay for this.

Now when you do Windows searches, it will display the “Date accessed” category and you can organize it better than this picture by just clicking the Category name.

Windows 7 screenshot -using date accessed in search.

Comments or suggestions? Post it below or join the discussion in the groovyPost community forum!



  1. Shockersh

    Lol nice… I had no idea it was turned off. Just checked and yup , your right!!

    • MrGroove

      Yeah, you would think Microsoft wouldn’t be displaying the “Last Accessed Time” if they weren’t keeping track of it on the OS…

      Nice job ms….

  2. Dweeberly

    Very good post (great job with layout).

    I was actually trying to use the last accessed date, when I found that it was disabled. I followed the directions (including the reboot) but my accessed date still doesn’t change as expected. I have a test file that I “type”ed out (cmd prompt) in the command line, loaded into two editors (notepad, notepad++, opened file, closed file, no changes). I thought it was not working at all, then I see that it did update the last accessed time. I tried again and 20 mins later, there is still no update to this data. I even closed all my windows explorers and reopened one, still no change. Very odd. I suspect that MS shipped this feature disabled because it doesn’t work in a reliable way.

    Folks might want to reconsider turning this on, given that it doesn’t produce reliable results. Shame I could really use it

    Thanks for the info, perhaps MS will patch this in a SP.

  3. Dweeberly

    BTW I found out what was going on. This link

    Depends on the file system type I guess. For example, the last write time is not fully updated until all handles that are used for writing are closed, and NTFS candelays updates to the last access time for a file by up to 1 hour after the last access, or not at all if HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate is enabled.

    So updates for the last access time can be delayed by up to an hour.

  4. Spokeo

    This is great advice – thanks for the detailed description and the graphics. I was just saying today on another post (where I was looking to see how to open the command prompt as an administrator, as you suggest we do… it cmd doesn’t open this way automatically for me) that Microsoft will make us experts and will turn us into ex-Windows users. I am switching to Linux soon.

  5. JJ Barea

    Thanks a lot.
    This write up was very help and well written.
    I just followed your instructions and i was good.

  6. Peter Goodger

    I thank you for your post it was very helpful. I wish to ask a question, at any time during the XP Windows evolution was the Last Accessed Time stamp activated? In other words was it automatic or required manual starting via cmd.

    • MrGroove

      Hi Peter – I’m pretty sure it was Auto.

  7. Jay Tensing

    I tried exactly the fsutil command from the command prompt to disable the NTFS. I also changed the registry default settings on the ntfsDisableLastAccessUpdate file. I have then done a reboot but the access times on the file still change to the current date when I copy the files from one folder to another.
    I am using Windows 7. Please let me know if there is anything else that I am missing inorder to disable the NTFS Time Access.
    thanks !!

  8. rubel

    thanks for ur useful post. but I need to know that, “which files have been accessed when I was not in home?” is this possible by any third party software?

    • Austin Krause

      Rubel, just use the search function outlined in the article above. Once you’ve sorted results by the date accessed you can just compare the times you were not home with the times the files were accessed.

      For example, if you work from 9am-5pm. You’ll know that most files probably shouldn’t have been accessed between that time, so if you see a file accessed during that time in the search results you should probably inspect what is causing it.

  9. montanaksc

    I have been frustrated by Windows 7 disabling this time stamp which has been valuable to timekeeping in our office. What luck that I was FINALLY so frustrated I searched to find out if there was a solution and–here it is! I’m looking foward to seeing my “Accessed” column active again after I reboot–Thank You!

  10. Sebastian

    There is any way to order files by access count, in other words,windows stores the amount of access to the files?
    I want to order by this criteria.

    Thanks in advanced.

  11. mark owen

    thanks very very much

  12. Jeff Mowery

    very detailed explanation. However I have Windows 7 Ultimate and my file access date always changed upon copying/cutting the file, and I did not do anything as far as settings go.

  13. Rosie

    Thank you for your post. My computer already shows the “Last Access Time” for each file but not for my folders. Do you know if it is possible to find the “Last Access Time” of a folder?

  14. Jostikas

    I should note that there is a good reason, now even more than in vista days, why access time is disabled. Writing access timestamps produces a lot of small random writes.

    Back then, computers were mainly HDD-based, and HDD-s are notoriously slow when it comes to random access. However, given that the update would happen while the file is read anyway, it’s at least possible to optimize it, so it happen in one pass.

    Now, more and more computers have SSD-s, and large amounts of tiny writes actively degrades the flash memory that SSDs are based on. SSD-s can do tiny random reads at blazing speeds, but it is the nature of flash memory that a tiny overwrite causes rewriting of a whole page. And writing is what degrades an SSD.

  15. Tim

    Enabling this does change date accessed, but for every single file in the same folder as the file I actually accessed. Why do they all update just because they were in the same folder? I want each individual file to update when I open each file, not the entire folder.

Leave a Reply

Your email address will not be published. Required fields are marked *


To Top