Asked by:
LastAccessTime - Querying Folder Properties Resets TimeStamp

Question
-
I have enabled the LastAccessTime attribute on a handful of old servers in hopes to start detecting folders/file that are not being used. This works as it should.
I am trying to select the LastAccessTime on folders (and subfolders). I am able to do so. However a couple of items to note.
First, the process of actually pulling back the property for LastAccessTime winds up changing the timestamp to the time of the query. This isn't good. I get it, but this isn't good. Of course as it grabs the subfolders, you are actually accessing the parent folder.
Second, I am not getting consistent results. I queried a folder with five subfolders. The time doesn't stay consistent. However it will eventually report on the query time.
I have tried various iterations of the command such as using -Directory or in the example below, specifying that it is a container. With this example, you can see that the timestamp doesn't stay consistent. The command was run three times with no more than 60 seconds between execution.
My Question would be... Is there a way to pull back the LastAccessTime property from directories and sub-directories without causing the LastAccessTime property to be changed? (My guess is no.)
PS C:\Users\me> get-childitem \\SomeServer\i$\RmtPrint-Backup -recurse | ? {$_.PSIsContainer -eq "True"} | Select FullName,LastAccessTime,LastWriteTime
FullName LastAccessTime LastWriteTime
-------- -------------- -------------
\\SomeServer\i$\RmtPrint-Backup\Week-1 2/5/2019 2:50:07 PM 8/6/2018 4:28:00 AM
\\SomeServer\i$\RmtPrint-Backup\Week-2 2/5/2019 2:50:07 PM 8/13/2018 4:29:01 AM
\\SomeServer\i$\RmtPrint-Backup\Week-3 2/5/2019 2:50:07 PM 8/20/2018 3:28:46 AM
\\SomeServer\i$\RmtPrint-Backup\Week-4 2/5/2019 2:50:07 PM 8/27/2018 3:39:20 AM
\\SomeServer\i$\RmtPrint-Backup\Week-5 2/5/2019 2:50:07 PM 7/30/2018 2:04:42 AM
PS C:\Users\me> get-childitem \\SomeServer\i$\RmtPrint-Backup -recurse | ? {$_.PSIsContainer -eq "True"} | Select FullName,LastAccessTime,LastWriteTime
FullName LastAccessTime LastWriteTime
-------- -------------- -------------
\\SomeServer\i$\RmtPrint-Backup\Week-1 2/5/2019 2:34:31 PM 8/6/2018 4:28:00 AM
\\SomeServer\i$\RmtPrint-Backup\Week-2 2/5/2019 2:34:31 PM 8/13/2018 4:29:01 AM
\\SomeServer\i$\RmtPrint-Backup\Week-3 2/5/2019 2:34:31 PM 8/20/2018 3:28:46 AM
\\SomeServer\i$\RmtPrint-Backup\Week-4 2/5/2019 2:34:31 PM 8/27/2018 3:39:20 AM
\\SomeServer\i$\RmtPrint-Backup\Week-5 2/5/2019 2:34:31 PM 7/30/2018 2:04:42 AM
PS C:\Users\me> get-childitem \\SomeServer\i$\RmtPrint-Backup -recurse | ? {$_.PSIsContainer -eq "True"} | Select FullName,LastAccessTime,LastWriteTime
FullName LastAccessTime LastWriteTime
-------- -------------- -------------
\\SomeServer\i$\RmtPrint-Backup\Week-1 2/5/2019 2:54:38 PM 8/6/2018 4:28:00 AM
\\SomeServer\i$\RmtPrint-Backup\Week-2 2/5/2019 2:54:38 PM 8/13/2018 4:29:01 AM
\\SomeServer\i$\RmtPrint-Backup\Week-3 2/5/2019 2:54:38 PM 8/20/2018 3:28:46 AM
\\SomeServer\i$\RmtPrint-Backup\Week-4 2/5/2019 2:54:38 PM 8/27/2018 3:39:20 AM
\\SomeServer\i$\RmtPrint-Backup\Week-5 2/5/2019 2:54:38 PM 7/30/2018 2:04:42 AM
PS C:\Users\me>Tuesday, February 5, 2019 9:54 PM
All replies
-
It's possible to do this.
https://docs.microsoft.com/en-us/windows/desktop/api/fileapi/nf-fileapi-setfiletime
It isn't necessary to read the files contents. Just open it and immediately set the last accessed time to 0xFFFFFFFF.
--- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)
- Proposed as answer by LeeSeenLiMicrosoft contingent staff Wednesday, February 6, 2019 6:52 AM
Tuesday, February 5, 2019 10:17 PM -
Hi,
Was your issue resolved?
If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.
If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.
If no, please reply and tell us the current situation in order to provide further help.
Best Regards,
Lee
Just do it.
Thursday, February 21, 2019 6:39 AM