General: How to improve legacy OS performance (helps virtual machine performance also)

  • Article

Its been a bit of time since my last posting and we in the Hyper-V team have been heads down on RC. Can't wait for you to get ahold of it.

Today's posting is about the joys of Last Access Timestamps. This feature has been in NTFS since the beginning and in Vista and Windows Server 2008 (WS08) we turned it off. So what is this feature and why did it get turned off?

First a little history. The Last Access Timestamp was used to track any time a file got touched such as an open, read, write, ... Windows not only has the ability to track the last access time it also has the ability to "audit" such access (https://support.microsoft.com/kb/814595). Since the last access timestamp tracked writes (as did last modified time which remains active) many file synchronization, virus scanners and desktop search products used it to determine when to sync, rescan or reindex a files contents. The problem with the last access timestamp is that it causes a lot of meta data writes to $MFT (NTFS's master index of files and directories). A simple “dir” or opening the File Browser would cause the directories last access timestamp to update. This in turn would cause the programs depending on it to start extra work.

If sync, virus scanners, and desktop search products used the last access time why do this products still work on Vista and WS08? The answer is most of these products now use filter drivers (a thin piece of software in the I/O path) or the NTFS USN journal. Even though last modified times still work they tend to not be used. This is one of the reasons why you have to update these products for Vista and WS08. In the end there is a real benefit in better performance.

With the history lesson over if you want to gain that last once of performance from your legacy OS (XP, Windows Server 2003, Windows 2000, ...) you can turn off the last access timestamp by setting the following registry key;

Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
Name: NtfsDisableLastAccessUpdate
Type: REG_DWORD
Value: 1

(check out the Windows Server 2003 performance tuning guidelines for use of the registry key. https://download.microsoft.com/download/2/8/0/2800a518-7ac6-4aac-bd85-74d2c52e1ec6/tuning.doc . Here is the Windows Server 2008 guidelines https://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/Perf-tun-srv.docx )

Remember the history lesson - you need to update your sync, virus scanning, and indexing software to make sure it works without depending on the Last Access Timestamp.

This change can we particularly beneficial in VM’s due to the reduction in I/O.

 - Tony