How to Disable NTFS Last Access Time Updates in Windows 11 Using fsutil to Improve Disk Performance

Modern storage drives—such as high-speed NVMe and SATA solid-state drives (SSDs)—process gigabytes of data each second. However, legacy filesystem behaviours inherited from early computing architectures can still introduce unnecessary disk write overhead. By default in the New Technology File System (NTFS), Windows updates the Last Access Time metadata stamp whenever a directory is queried, a script traverses a folder tree, or an application reads a file. Understanding how to disable NTFS last access time updates in Windows 11 using fsutil allows administrators and power users to eliminate redundant write cycles, extend SSD longevity, and enhance disk performance during file-intensive workflows.

Every read operation that alters metadata essentially converts a passive read into an active disk write. While tracking the last access timestamp was historically useful for tape-drive archiving and rudimentary data backup policies, modern Windows services rarely depend on it. This comprehensive guide explains the mechanics of NTFS last access timestamps, provides step-by-step instructions to configure timestamp behaviour using the command-line fsutil utility and Windows Registry, and outlines which specialized applications still rely on access tracking.

How NTFS Last Access Time Affects Drive Performance

Whenever a program opens a document, reads an image file, or indexes source code, NTFS records the access event in the Master File Table (MFT). This continuous metadata maintenance impacts the storage subsystem in several ways:

Operational Factor	Default Last Access State	Disabled Last Access State
Read-to-Write Conversion	Pure read operations generate subsequent disk writes to update the MFT record.	Read operations remain purely passive reads, generating zero metadata writes.
File System I/O Overhead	Higher disk input/output operations per second (IOPS) during directory traversal.	Reduced IOPS; significant speedups when compiling code or scanning git repositories.
SSD Flash Memory Wear	Increases write amplification factor (WAF) across NAND flash cells over time.	Eliminates unnecessary write cycles, directly preserving drive endurance.
Battery Consumption	Storage controllers and drive buses stay awake longer to flush updated metadata.	Drives return to low-power idle states immediately after completing reads.

In modern Windows 11 builds, Microsoft partially mitigates this by applying a 1-hour resolution buffer to timestamps; however, completely disabling the feature provides the most consistent I/O efficiency.

Understanding fsutil disablelastaccess Bitmask Values

The Windows filesystem utility (fsutil) configures last access time updates via a bitmask parameter called disablelastaccess. The integer values correspond to the following operating modes:

• 0 — User Managed, Last Access Enabled: All file reads update the last access timestamp unconditionally.
• 1 — User Managed, Last Access Disabled: Timestamp updates are completely suppressed across all NTFS volumes. (Recommended for optimal performance).
• 2 — System Managed, Last Access Enabled: Windows automatically enables updates based on detected storage policies.
• 3 — System Managed, Last Access Disabled: Windows manages settings automatically but defaults to disabling updates unless an administrative service explicitly requires them.

Checking the Current Last Access State in Windows 11

Before making adjustments, check the current configuration of your operating system using an elevated command prompt:

1. Press the Windows Key, type cmd or Terminal.
2. Right-click the result and select Run as administrator.
3. Execute the following query command:

fsutil behavior query disablelastaccess

The console will display the active status and the corresponding integer state, for example:

disablelastaccess = 3 (System Managed, Last Access Updates Disabled)

Disabling NTFS Last Access Updates via fsutil

To enforce a permanent, user-managed policy that completely disables last access timestamp updates across all internal and external NTFS volumes, follow these steps:

1. Open an administrative Command Prompt or PowerShell window.
2. Enter the following command to set the state to 1:

fsutil behavior set disablelastaccess 1

The terminal will return a confirmation message:

disablelastaccess = 1 (User Managed, Last Access Updates Disabled)

Although the filesystem driver applies the policy immediately to subsequent I/O requests, it is best practice to restart Windows 11 to ensure all background services, indexing daemons, and storage filter drivers adopt the new setting cleanly.

Alternative Method: Disabling Last Access Updates via the Windows Registry

If you manage multiple enterprise workstations via group policies or deployment scripts that apply .reg configuration keys, you can adjust the value directly inside the Windows Registry:

1. Press Win + R, type regedit, and press Enter to launch the Registry Editor.
2. Navigate to the following registry path in the address bar:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem

3. In the right-hand panel, locate the DWORD value named NtfsDisableLastAccessUpdate. (If it does not exist, right-click, select New > DWORD (32-bit) Value, and name it accordingly).
4. Double-click NtfsDisableLastAccessUpdate, set the Base to Decimal, and enter 1 in the Value data field.
5. Click OK and close the Registry Editor.
6. Restart your computer to apply the registry configuration.

Which Applications Rely on Last Access Timestamps?

Before applying this change, verify whether any specialised software in your workflow depends on access times:

• Enterprise HSM and Hierarchical Storage Management: High-end data archiving tools that automatically migrate cold files to tape drives or remote cloud tiers after 90 days of inactivity read last access stamps. If you run hierarchical archival software, keep the default setting.
• Audit-Heavy Compliance Frameworks: Certain forensic logging agents track last access times for digital forensics. However, standard security auditing (such as File System Object Access logging) uses security event audit logs rather than filesystem metadata.
• Standard Daily Use: Web browsers, video games, office productivity suites, code compilers (Visual Studio, GCC, Rust), and Windows Search indexing function flawlessly with last access updates disabled.

Troubleshooting and Verifying Changes

To confirm that your changes are functioning as expected, verify the configuration with these checks:

• Command Reverts After Restart: If the setting reverts to 2 or 3 after rebooting, third-party system optimization utilities or enterprise Mobile Device Management (MDM) policies (such as Microsoft Intune) may be enforcing overriding configurations. Check group policy settings under Computer Configuration > Administrative Templates > System > Filesystem > NTFS.
• Access Denied Error: If fsutil returns Error: Access is denied. You must be an administrator to perform this operation, ensure you launched Command Prompt or PowerShell with explicit Run as administrator rights.
• Checking File Timestamps in PowerShell: You can verify that access times stop changing by inspecting a test file: Get-Item C:\test.txt | Select-Object LastAccessTime, reading the file, and querying the property again. The timestamp will remain unchanged.

By executing fsutil behavior set disablelastaccess 1 in Windows 11, you eliminate persistent background metadata thrashing, optimise drive performance during large file transfers and source compilation, and minimise unnecessary wear on your solid-state drives.