Notification

Icon
Error

File Scanning - wrong date in table tblFileVersions - LastAccessed

Posted: Thursday, February 20, 2020 2:15:03 PM(UTC)
Horst

Horst

Member Original PosterPosts: 2
0
Like
I use file scanning to see when a program was last accessed, for example

%programfiles(x86)%\Microsoft Office\Office16\winword.exe

Even though i use the software every day, the result of "lastaccess" is in the past: 05/02/2020

The Clients are scanned every day, i tried also single asset rescans.

I also receive wrong data when querying other program files


Any Idea?





pryan67
#1pryan67 Member Posts: 58  
posted: 2/20/2020 6:21:55 PM(UTC)
Interesting...I just set up a similar report and see the same thing. What it appears to me at first glance is that the "last accessed" date matches my boot date/time. I wonder if there's something to that...I'll have to reboot and see if I can figure this out. It would certainly be a useful way to audit software usage, if it works properly.
RKCar
#2RKCar Member Posts: 79  
posted: 2/20/2020 6:40:37 PM(UTC)
The last accessed date within Lansweeper is based solely off of the last accessed date within the properties of the file. By default the updating of file access time is disabled within Windows as a performance tweak as it causes an increased amount of drive writes. This is especially worth pointing out because SSDs can only perform so many writes before they start to degrade. In other words, enable at your own risk.

To turn it on modify the following registry value:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
NtfsDisableLastAccessDate

Set it to 0.
pryan67
#3pryan67 Member Posts: 58  
posted: 2/20/2020 7:28:19 PM(UTC)
Originally Posted by: RKCar Go to Quoted Post
The last accessed date within Lansweeper is based solely off of the last accessed date within the properties of the file. By default the updating of file access time is disabled within Windows as a performance tweak as it causes an increased amount of drive writes. This is especially worth pointing out because SSDs can only perform so many writes before they start to degrade. In other words, enable at your own risk.

To turn it on modify the following registry value:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
NtfsDisableLastAccessDate

Set it to 0.


Thanks...that's very helpful



Horst
#4Horst Member Original PosterPosts: 2  
posted: 2/21/2020 8:49:44 AM(UTC)
Thank you very much for your comments.

The background of my question is that I would like to find out which users do not use assigned Adobe licenses.
The query of the last accessed date does not bring the desired result.
I also think that for example an access of a backup or a virus protection would also change the date.

The entry in the registry of windows 10 is called
Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate
The value is 80000003 (hexadecimal)
RKCar
#5RKCar Member Posts: 79  
posted: 2/21/2020 2:22:54 PM(UTC)
I think technically you may be correct, but without testing it I can't say for certain. Assuming you are correct, in reality that is still the last accessed date. You can't tell it that you want to know the last access date, but only when it is by a user and not the system. Without tools that would cost additional money, the only way I can think to do something like this is to enable security auditing for process start/stop and then deal with the log entries that are created as it should associate users to it. That is at least something you can tell Lansweeper to pull in. It may be overwhelming, but it is something you can filter against.

EventID is 4688 and it shows up in the security log.

secpol.msc
Local Policies\Audit Policy\Audit Process tracking

Active Discussions

Lansweeper Find machines missing any 1 of several apps
by  BennettL   Go to last post Go to first unread
Last post: Yesterday at 8:35:28 PM(UTC)
Lansweeper Max Software Version and Deploy to Only Outdated
by  GenDev   Go to last post Go to first unread
Last post: Yesterday at 1:06:50 PM(UTC)
Lansweeper Patch Tuesday - Superseded MS Updates
by  doone128  
Go to last post Go to first unread
Last post: Yesterday at 11:27:10 AM(UTC)
Lansweeper Report on basic Router information
by  Liljack  
Go to last post Go to first unread
Last post: 3/30/2020 7:44:22 AM(UTC)
Lansweeper Windows: Static IP address configured (Built-in)
by  RobinPSU   Go to last post Go to first unread
Last post: 3/27/2020 8:52:12 PM(UTC)
Lansweeper Adding top user to asset report
by  Argon0  
Go to last post Go to first unread
Last post: 3/26/2020 5:20:51 PM(UTC)