Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to decrypt some EFS-encrypted files, but I do not know how to do that without altering the timestamp. When encrypting/decrypting files, the modified-time is set to the current time. I'd like to preserve the original timestamp, as the file content have not really changed.

Is this possible? Solutions i don't think work

  • copy to/from FAT (timestamp resolution differs)

  • copy to from Samba share (same)

  • programmatically copy original timestamp and reapply after decryption (possible, but need to handle decryption time which may vary)

share|improve this question

This might help, though I haven't tried it myself:




Value: 1

If it doesn't exist you may have to create it.

You may also be able to use this command from the command prompt, with administrate privileges, of course:

fsutil behavior set disablelastaccess

share|improve this answer
I don't think this is related to my problem, I read the following "(NtfsDisableLastAccessUpdate)...Determines whether NTFS updates the last-access timestamp on each directory when it lists the directories on an NTFS volume." – grojo Dec 15 '09 at 7:50
up vote 0 down vote accepted

This might work:

  • Set up a network share on a remote machine with NTFS encryption disabled (run "fsutil behavior set disableencryption 1" ).
  • Copy to/from it
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.