{
	"id": "df0dbc69-b5e4-45b0-845b-2ba56e0128dc",
	"created_at": "2026-04-06T00:21:57.797322Z",
	"updated_at": "2026-04-10T13:12:21.427928Z",
	"deleted_at": null,
	"sha1_hash": "f8becbe97563a70c659cfd7f16b688d32376f126",
	"title": "fsutil behavior",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 81324,
	"plain_text": "fsutil behavior\r\nBy robinharwood\r\nArchived: 2026-04-06 00:04:07 UTC\r\nQueries or sets NTFS volume behavior, which includes:\r\nCreating the 8.3 character-length file names.\r\nExtending character use in 8.3 character-length short file names on NTFS volumes.\r\nUpdating of the Last Access Time stamp when directories are listed on NTFS volumes.\r\nThe frequency with which quota events are written to the system log and to NTFS paged pool and NTFS\r\nnon-paged pool memory cache levels.\r\nThe size of the master file table zone (MFT Zone).\r\nSilent deletion of data when the system encounters corruption on an NTFS volume.\r\nFile-delete notification (also known as trim or unmap).\r\nfsutil behavior query {allowextchar | bugcheckoncorrupt | disable8dot3 [\u003cvolumepath\u003e] | disablecompression | di\r\nfsutil behavior set {allowextchar {1|0} | bugcheckoncorrupt {1|0} | disable8dot3 [ \u003cvalue\u003e | [\u003cvolumepath\u003e {1|0}\r\nParameter Description\r\nquery Queries the file system behavior parameters.\r\nset Changes the file system behavior parameters.\r\nallowextchar {1|0}\r\nAllows (1) or disallows (0) characters from the extended character set\r\n(including diacritic characters) to be used in 8.3 character-length short\r\nfile names on NTFS volumes.\r\nYou must restart your computer for this parameter to take effect.\r\nBugcheckoncorrupt {1|0}\r\nAllows (1) or disallows (0) generation of a bug check when there is\r\ncorruption on an NTFS volume. This feature can be used to prevent\r\nNTFS from silently deleting data when used with the Self-Healing NTFS\r\nfeature.\r\nYou must restart your computer for this parameter to take effect.\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior\r\nPage 1 of 6\n\nParameter Description\r\ndisable8dot3 [ \u003cvolumepath\u003e ]\r\n{1|0}\r\nDisables (1) or enables (0) the creation of 8.3 character-length file names\r\non FAT- and NTFS-formatted volumes. Optionally, prefix with the\r\nvolumepath specified as a drive name followed by a colon or GUID.\r\ndisablecompression {1|0}\r\nDisables (1) or enables (0) NTFS compression.\r\nYou must restart your computer for this parameter to take effect.\r\ndisablecompressionlimit {1|0}\r\nDisables (1) or enables (0) NTFS compression limit on NTFS volume.\r\nWhen a compressed file reaches a certain level of fragmentation, rather\r\nthan failing to extend the file, NTFS stops compressing additional extents\r\nof the file. This was done to allow compressed files to be larger than they\r\nnormally would be. Setting this value to TRUE disables this feature\r\nwhich limits the size of compressed files on the system. We don't\r\nrecommend disabling this feature.\r\nYou must restart your computer for this parameter to take effect.\r\ndisableencryption {1|0}\r\nDisables (1) or enables (0) the encryption of folders and files on NTFS\r\nvolumes.\r\nYou must restart your computer for this parameter to take effect.\r\ndisablefilemetadataoptimization\r\n{1|0}\r\nDisables (1) or enables (0) file metadata optimization. NTFS has a limit\r\non how many extents a given file can have. Compressed and sparse files\r\ncan become very fragmented. By default, NTFS periodically compacts its\r\ninternal metadata structures to allow for more fragmented files. Setting\r\nthis value to TRUE disables this internal optimization. We don't\r\nrecommend disabling this feature.\r\nYou must restart your computer for this parameter to take effect.\r\ndisablelastaccess {1|0}\r\nDisables (1) or enables (0) updates to the Last Access Time stamp on\r\neach directory when directories are listed on an NTFS volume.\r\nYou must restart your computer for this parameter to take effect.\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior\r\nPage 2 of 6\n\nParameter Description\r\ndisablespotcorruptionhandling\r\n{1|0}\r\nDisables (1) or enables (0) spot corruption handling. Also allows system\r\nadministrators to run CHKDSK to analyze the state of a volume without\r\ntaking it offline. We don't recommend disabling this feature.\r\nYou must restart your computer for this parameter to take effect.\r\ndisabletxf {1|0}\r\nDisables (1) or enables (0) txf on the specified NTFS volume. TxF is an\r\nNTFS feature that provides transaction like semantics to file system\r\noperations. TxF is presently deprecated, but the functionality is still\r\navailable. We don't recommend disabling this feature on the C: volume.\r\nYou must restart your computer for this parameter to take effect.\r\ndisablewriteautotiering {1|0}\r\nDisables ReFS v2 auto tiering logic for tiered volumes.\r\nYou must restart your computer for this parameter to take effect.\r\nencryptpagingfile {1|0}\r\nEncrypts (1) or doesn't encrypt (0) the memory paging file in the\r\nWindows operating system.\r\nYou must restart your computer for this parameter to take effect.\r\nmftzone \u003cvalue\u003e\r\nSets the size of the MFT Zone, and is expressed as a multiple of 200MB\r\nunits. Set value to a number from 1 (default is 200 MB) to 4 (maximum\r\nis 800 MB).\r\nYou must restart your computer for this parameter to take effect.\r\nmemoryusage \u003cvalue\u003e\r\nConfigures the internal cache levels of NTFS paged-pool memory and\r\nNTFS nonpaged-pool memory. Set to 1 or 2. When set to 1 (the default),\r\nNTFS uses the default amount of paged-pool memory. When set to 2,\r\nNTFS increases the size of its lookaside lists and memory thresholds. (A\r\nlookaside list is a pool of fixed-size memory buffers that the kernel and\r\ndevice drivers create as private memory caches for file system operations,\r\nsuch as reading a file.)\r\nYou must restart your computer for this parameter to take effect.\r\nquotanotify \u003cfrequency\u003e Configures how frequently NTFS quota violations are reported in the\r\nsystem log. Valid values for are in the range 0 - 4294967295. The default\r\nfrequency is 3600 seconds (one hour).\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior\r\nPage 3 of 6\n\nParameter Description\r\nYou must restart your computer for this parameter to take effect.\r\nsymlinkevaluation\r\n\u003csymboliclinktype\u003e\r\nControls the kind of symbolic links that can be created on a computer.\r\nValid choices are:\r\n1 - Local to local symbolic links, L2L:{0|1}\r\n2 - Local to remote symbolic links, L2R:{1|0}\r\n3 - Remote to local symbolic links, R2L:{1|0}\r\n4 - Remote to remote symbolic links, R2R:{1|0}\r\ndisabledeletenotify\r\nDisables (1) or enables (0) delete notifications. Delete notifications (also\r\nknown as trim or unmap) is a feature that notifies the underlying storage\r\ndevice of clusters that have been freed due to a file delete operation. In\r\naddition:\r\nFor systems using ReFS v2, trim is disabled by default.\r\nFor systems using ReFS v1, trim is enabled by default.\r\nFor systems using NTFS, trim is enabled by default unless an\r\nadministrator disables it.\r\nIf your hard disk drive or SAN reports that it doesn't support trim,\r\nthen your hard disk drive and SANs don't get trim notifications.\r\nEnabling or disabling doesn't require a restart.\r\nTrim is effective when the next unmap command is issued.\r\nExisting inflight IO are not impacted by the registry change.\r\nDoesn't require any service restart when you enable or disable\r\ntrim.\r\nThe MFT Zone is a reserved area that enables the master file table (MFT) to expand as needed to prevent\r\nMFT fragmentation. If the average file size on the volume is 2 KB or less, it can be beneficial to set the\r\nmftzone value to 2. If the average file size on the volume is 1 KB or less, it can be beneficial to set the\r\nmftzone value to 4.\r\nWhen disable8dot3 is set to 0, every time you create a file with a long file name, NTFS creates a second\r\nfile entry that has an 8.3 character-length file name. When NTFS creates files in a directory, it must look up\r\nthe 8.3 character-length file names that are associated with the long file names. This parameter updates the\r\nHKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\NtfsDisable8dot3NameCreation registry\r\nkey.\r\nThe allowextchar parameter updates the\r\nHKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\NtfsAllowExtendedCharacterIn8dot3Name\r\nregistry key.\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior\r\nPage 4 of 6\n\nThe disablelastaccess parameter reduces the impact of logging updates to the Last Access Time stamp on\r\nfiles and directories. Disabling the Last Access Time feature improves the speed of file and directory\r\naccess. This parameter updates the\r\nHKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\NtfsDisableLastAccessUpdate registry key.\r\nNotes:\r\nFile-based Last Access Time queries are accurate even if all on-disk values aren't current. NTFS\r\nreturns the correct value on queries because the accurate value is stored in memory.\r\nOne hour is the maximum amount of time that NTFS can defer updating Last Access Time on disk.\r\nIf NTFS updates other file attributes such as Last Modify Time, and a Last Access Time update is\r\npending, NTFS updates Last Access Time with the other updates without additional performance\r\nimpact.\r\nThe disablelastaccess parameter can affect programs such as Backup and Remote Storage, which\r\nrely on this feature.\r\nIncreasing the physical memory doesn't always increase the amount of paged pool memory available to\r\nNTFS. Setting memoryusage to 2 raises the limit of paged pool memory. This might improve performance\r\nif your system is opening and closing many files in the same file set and is not already using large amounts\r\nof system memory for other apps or for cache memory. If your computer is already using large amounts of\r\nsystem memory for other apps or for cache memory, increasing the limit of NTFS paged and non-paged\r\npool memory reduces the available pool memory for other processes. This might reduce overall system\r\nperformance. This parameter updates the\r\nHKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\NtfsMemoryUsage registry key.\r\nThe value specified in the mftzone parameter is an approximation of the initial size of the MFT plus the\r\nMFT Zone on a new volume, and it is set at mount time for each file system. As space on the volume is\r\nused, NTFS adjusts the space reserved for future MFT growth. If the MFT Zone is already large, the full\r\nMFT Zone size is not reserved again. Because the MFT Zone is based on the contiguous range past the end\r\nof the MFT, it shrinks as the space is used.\r\nThe file system doesn't determine the new MFT Zone location until the current MFT Zone is completely\r\nused. Note that this never occurs on a typical system.\r\nSome devices may experience performance degradation when the delete notification feature is turned on. In\r\nthis case, use the disabledeletenotify option to turn off the notification feature.\r\nTo query for the disable 8dot3 name behavior for a disk volume specified with the GUID, {928842df-5a01-11de-a85c-806e6f6e6963}, type:\r\nfsutil behavior query disable8dot3 volume{928842df-5a01-11de-a85c-806e6f6e6963}\r\nYou can also query the 8dot3 name behavior by using the 8dot3name subcommand.\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior\r\nPage 5 of 6\n\nTo query the system to see if TRIM is enabled or not, type:\r\nfsutil behavior query DisableDeleteNotify\r\nThis yields an output similar to this:\r\nNTFS DisableDeleteNotify = 1\r\nReFS DisableDeleteNotify is not currently set\r\nTo override the default behavior for TRIM (disabledeletenotify) for ReFS v2, type:\r\nfsutil behavior set disabledeletenotify ReFS 0\r\nTo override the default behavior for TRIM (disabledeletenotify) for NTFS and ReFS v1, type:\r\nfsutil behavior set disabledeletenotify 1\r\nCommand-Line Syntax Key\r\nfsutil\r\nfsutil 8dot3name\r\nSource: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior\r\nhttps://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior\r\nPage 6 of 6",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior"
	],
	"report_names": [
		"fsutil-behavior"
	],
	"threat_actors": [],
	"ts_created_at": 1775434917,
	"ts_updated_at": 1775826741,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/f8becbe97563a70c659cfd7f16b688d32376f126.pdf",
		"text": "https://archive.orkl.eu/f8becbe97563a70c659cfd7f16b688d32376f126.txt",
		"img": "https://archive.orkl.eu/f8becbe97563a70c659cfd7f16b688d32376f126.jpg"
	}
}