I need to determine if a particular file was accessed in the last, say, 2 days.

Is this possible on Windows Server 2008 R2?

4 Answers 4


After that fact? No, I do not believe so unless an auditing ACL was inherited from a parent or set directly on the file for the "read file" permission. If you DO enable file system auditing, you can then look at the security logs to find this information which most people will pipe or transfer to some kind of tool for parsing.

You can also take a look at using something like Tripwire for maintaining file integrity if that becomes a goal.

  • is it possible to make without using third-party utilities? windows tracks creation time, modification time, why it can't track "read time"? Jan 20, 2012 at 8:29
  • @javapowered Yes it is. As SpacemanSpiff mentioned. Use built in auditing. Read this: technet.microsoft.com/en-us/library/dd560628%28v=ws.10%29.aspx
    – Tom
    Jan 20, 2012 at 11:08
  • 1
    @javapowered - it's really not that much harder than setting file permissions. If you want to do this for just one file or directory, go to that directory. Open the properties dialog of the file/folder, go to the auditing tab. Add the "everyone" group or "domain users" if you are on a domain, and check the box for the "read" permission. This will create a security event log entry every time someone accesses the file. So then start reviewing the logs or dump them to a log reader looking for that file/folder to be mentioned. Jan 20, 2012 at 14:30
  • 1
    and.... be careful setting auditing at the root of a drive, it will likely cascade down and your log will go insane. fyi. Jan 20, 2012 at 14:31
  • 1
    Open Administrative tools, Event Viewer, and look at the security log Jan 20, 2012 at 15:35

Actually there is a way but it's been disabled by default since Vista/2008 and I just verified it's disabled by default in Win7/2008R2.

The registry setting NtfsDisableLastAccessUpdate located in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem now defaults to 1 for performance purposes. If you change that to a 0 then NTFS will update the LastAccessTime property of the file/folder.

You can see this value by looking at the properties of the file/folder or you can pull the information with a PowerShell script. Make sure you test first though to ensure the performance hit isn't too bad.

Also NTFS won't always update the information immediately. According to Microsoft:

The NTFS file system delays updates to the last access time for a file by up to 1 hour after the last access.

  • 1
    That's great to know, does it store who accessed it as well? Jan 22, 2012 at 21:32
  • 1
    No, just when it was accessed. If you need to know who then you'll need to enable auditing as mentioned in another answer.
    – murisonc
    Jan 25, 2012 at 1:34
  • @murisonc, Couldn't the malicious user simply use a program which restores the last accessed date back to the original value after it has accessed the files?
    – Pacerier
    Nov 22, 2014 at 16:10
  • @Pacerier, I'm sure a malicious user could find a way to forge it. To catch that you would have to enable auditing and make sure those audit entries are being forwarded to an audit collection sever.
    – murisonc
    Nov 24, 2014 at 19:45
  • How much of a performance impact does enabling NtfsDisableLastAccessUpdate have?
    – Stevoisiak
    Sep 27, 2018 at 15:50

As @murisonc pointed out, NTFS volumes on Windows can track the last access time, they just don't by default, and it is easily enabled by setting a registry key.

You can combine this with a file integrity monitoring tool, such as Verisys or Tripwire, which can provide automated alerting and reporting.

Filesystem auditing tools may be an option too, though many rely on enabling object auditing, which can kill performance. Some others rely on filesystem filter drivers instead, but these drivers can be a bit flakey.


This Guide should do the trick to enable audit on a file: http://www.discoveryourpc.net/2010/01/auditing-access-to-files-on-windows-7.html

It's for Windows 7 but is almost identical to 2008.

You could also use group policies for this. But as you stated you are not a professional admin this would not be the way for you.

You need to add a user or group to audit. I recommend adding the same group which has access on the parent folder.

You have to inform the users what you audit. In your case "file access". If you don't inform them the auditing could be illegal.

  • Thanks. i did exactly as you asked and it worked perfectly! Only issue is, it doesn't show the logs for before i enabled the audit access. How do i get it to do that?
    – user203207
    Dec 20, 2013 at 18:02
  • The discoveryourpc.net domain no longer exists (has no DNS entries). The link in the answer is dead. Feb 13, 2015 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .