I need to determine if a particular file was accessed in the last, say, 2 days.

Is this possible on Windows Server 2008 R2?


After that fact? No, I do not believe so unless an auditing ACL was inherited from a parent or set directly on the file for the "read file" permission. If you DO enable file system auditing, you can then look at the security logs to find this information which most people will pipe or transfer to some kind of tool for parsing.

You can also take a look at using something like Tripwire for maintaining file integrity if that becomes a goal.

  • is it possible to make without using third-party utilities? windows tracks creation time, modification time, why it can't track "read time"? – Oleg Vazhnev Jan 20 '12 at 8:29
  • @javapowered Yes it is. As SpacemanSpiff mentioned. Use built in auditing. Read this: technet.microsoft.com/en-us/library/dd560628%28v=ws.10%29.aspx – Tom Jan 20 '12 at 11:08
  • 1
    @javapowered - it's really not that much harder than setting file permissions. If you want to do this for just one file or directory, go to that directory. Open the properties dialog of the file/folder, go to the auditing tab. Add the "everyone" group or "domain users" if you are on a domain, and check the box for the "read" permission. This will create a security event log entry every time someone accesses the file. So then start reviewing the logs or dump them to a log reader looking for that file/folder to be mentioned. – SpacemanSpiff Jan 20 '12 at 14:30
  • 1
    and.... be careful setting auditing at the root of a drive, it will likely cascade down and your log will go insane. fyi. – SpacemanSpiff Jan 20 '12 at 14:31
  • 1
    Open Administrative tools, Event Viewer, and look at the security log – SpacemanSpiff Jan 20 '12 at 15:35

Actually there is a way but it's been disabled by default since Vista/2008 and I just verified it's disabled by default in Win7/2008R2.

The registry setting NtfsDisableLastAccessUpdate located in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem now defaults to 1 for performance purposes. If you change that to a 0 then NTFS will update the LastAccessTime property of the file/folder.

You can see this value by looking at the properties of the file/folder or you can pull the information with a PowerShell script. Make sure you test first though to ensure the performance hit isn't too bad.

Also NTFS won't always update the information immediately. According to Microsoft:

The NTFS file system delays updates to the last access time for a file by up to 1 hour after the last access.

  • 1
    That's great to know, does it store who accessed it as well? – SpacemanSpiff Jan 22 '12 at 21:32
  • 1
    No, just when it was accessed. If you need to know who then you'll need to enable auditing as mentioned in another answer. – murisonc Jan 25 '12 at 1:34
  • @murisonc, Couldn't the malicious user simply use a program which restores the last accessed date back to the original value after it has accessed the files? – Pacerier Nov 22 '14 at 16:10
  • @Pacerier, I'm sure a malicious user could find a way to forge it. To catch that you would have to enable auditing and make sure those audit entries are being forwarded to an audit collection sever. – murisonc Nov 24 '14 at 19:45
  • How much of a performance impact does enabling NtfsDisableLastAccessUpdate have? – Stevoisiak Sep 27 '18 at 15:50

As @murisonc pointed out, NTFS volumes on Windows can track the last access time, they just don't by default, and it is easily enabled by setting a registry key.

You can combine this with a file integrity monitoring tool, such as Verisys or Tripwire, which can provide automated alerting and reporting.

Filesystem auditing tools may be an option too, though many rely on enabling object auditing, which can kill performance. Some others rely on filesystem filter drivers instead, but these drivers can be a bit flakey.


This Guide should do the trick to enable audit on a file: http://www.discoveryourpc.net/2010/01/auditing-access-to-files-on-windows-7.html

It's for Windows 7 but is almost identical to 2008.

You could also use group policies for this. But as you stated you are not a professional admin this would not be the way for you.

You need to add a user or group to audit. I recommend adding the same group which has access on the parent folder.

You have to inform the users what you audit. In your case "file access". If you don't inform them the auditing could be illegal.

  • Thanks. i did exactly as you asked and it worked perfectly! Only issue is, it doesn't show the logs for before i enabled the audit access. How do i get it to do that? – user203207 Dec 20 '13 at 18:02
  • The discoveryourpc.net domain no longer exists (has no DNS entries). The link in the answer is dead. – Peter Hansen Feb 13 '15 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.