Fsutil: behavior

Queries the current settings for generating 8.3 character-length file names, allowing extended characters in 8.3 character-length file names on NTFS volumes, updating the last access timestamp on NTFS volumes, how often quota events are written to the system log, and the size of the master file table (MFT) Zone. Enables or disables the use of 8.3 character-length file names, allowing extended characters in 8.3 character-length file names on NTFS volumes, and updating the last access timestamp on NTFS volumes. Enables you to change how often quota events are written to the system log and to change the amount of disk space reserved for the MFT Zone.


fsutil behavior query {disable8dot3|allowextchar|disablelastaccess|quotanotify|mftzone}

fsutil behavior set [{disable8dot3 {1|0}|allowextchar {1|0}|disablelastaccess {1|0}|quotanotify frequency|mftzone value}]


query : Queries the file system behavior parameters.

set : Changes the file system behavior parameters.

disable8dot3 {1|0} : Disables creation of 8.3 character-length file names on FAT- and NTFS-formatted volumes.

allowextchar {1|0} : Determines whether characters from the extended character set, including diacritic characters, can be used in 8.3 short file names on NTFS volumes.

disablelastaccess {1|0} : Determines whether NTFS updates the last access timestamp on each directory when it lists the directories on an NTFS volume.

quotanotify frequency : Configures how frequently NTFS quota violations are reported in the system log. Enter a frequency 0 through 4294967295 seconds for how often quota violations are written to the system log. Default is 1 hour (3600 seconds).

mftzone value : The master file table (MFT) Zone is a reserved area that enables the MFT to expand as needed, in order to prevent MFT fragmentation. Set the value from 1 (default) to 4 (maximum). The value is in 8ths of the disk.


The behavior subcommand writes changes to the registry, so you must restart the computer for changes to take effect.

Using disable8dot3 {1|0}

When disable8dot3 is set to 0, every time you create a file with a long file name, NTFS creates a second file entry that has an 8.3 character-length file name. When NTFS creates files in a folder, it must look up the 8.3 character-length file names associated with the long file names.

This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation registry key.

Using allowextchar {1|0}

This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsAllowExtendedCharacterIn8dot3Name registry key.

Using disablelastaccess {1|0}

The disablelastaccess parameter is designed to reduce the logging impact of updating the last access timestamp on folders and directories. Disabling the Last Access Time improves the speed of folder and file access.

Each file and folder on an NTFS volume contains an attribute called Last Access Time. This attribute defines when the file or folder was last accessed, such as when a user lists folders, adds files to a folder, reads a file, or makes changes to a file. The most up-to-date Last Access Time is stored in memory and is eventually written to the disk in two different locations. One is within the file's attribute, which is part of its MFT record. The second is in the index of the directory that contains the file.

The Last Access Time on disk is not always current. This lag occurs because NTFS delays writing the Last Access Time to disk when users or programs perform read-only operations on a file or folder, such as listing the folder's contents or reading (but not changing) a file in the folder. If the Last Access Time is kept current on disk for read operations, all read operations become write operations, which impacts NTFS performance.

Note that file-based queries of Last Access Time are accurate even if all on-disk values are not current. NTFS returns the correct value on queries because the accurate value is stored in memory.

NTFS typically updates a file's attribute on disk if the current Last Access Time in memory differs by more than an hour from the Last Access Time stored on disk, or when all in-memory references to that file are gone, whichever is more recent. For example, if a file's current Last Access Time is 1:00 P.M., and you read the file at 1:30 P.M., NTFS does not update the Last Access Time. If you read the file again at 2:00 P.M., NTFS updates the Last Access Time in the file's attribute to reflect 2:00 P.M. because the file's attribute shows 1:00 P.M. and the in-memory Last Access Time shows 2:00 P.M.

NTFS updates the index of the directory that contains the file when NTFS updates the file's Last Access Time and detects that the Last Access Time for the file differs by more than an hour from the Last Access Time stored in the directory's index. This update typically occurs after a program closes the handle used to access a file within the directory. If the user holds the handle open for an extended time, a lag occurs before the change appears in the index entry of the directory.

Note that one hour is the maximum time that NTFS defers updating the Last Access Time on disk. If NTFS updates other file attributes such as Last Modify Time, and a Last Access Time update is pending, NTFS updates the Last Access Time along with the other updates without additional performance impact.

Note that using the disablelastaccess parameter can affect programs such as backup and Remote Storage that rely on this feature.

This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate registry key.

Using mftzone value 

The value is an approximation of the initial size of the MFT plus the MFT Zone on a new volume and is set at mount time for each file system. As space on the volume is used, NTFS adjusts the space reserved for future MFT growth. If the MFT Zone is already large, the full MFT Zone size is not reserved again. Since the MFT Zone is based on the contiguous range past the end of the MFT, it shrinks as the space is used.

The file system does not redetermine the MFT Zone location until the current MFT Zone is completely used. This never occurs on a typical system.


Fsutil: dirty

Fsutil: file

Fsutil: fsinfo

Fsutil: hardlink

Fsutil: objectid

Fsutil: quota

Fsutil: reparsepoint

Fsutil: sparse

Fsutil: usn

Fsutil: volume

Command-line reference A-Z

© 2017 Microsoft Corporation. All rights reserved. Contact Us |Terms of Use |Trademarks |Privacy & Cookies