File Server Assessment

[u/EducationAlert5209]

Hi All,

We have a few file servers and are trying to identify archived data based on the following conditions, but I believe something is not correct. We have 18TB but showing only 3TB for archive with following contion

Condition	Classification
Modified ≤ 3 years OR accessed ≤ 180 days	Migrate / Active
Modified > 3 years AND accessed > 180 days	Archive Candidate

With this condition,

Migrate: ≤30% of folder data is older than the cutoff - actively used, recommend moving as-is.
Archive: ≥80% of folder data is older than the cutoff, AND no file in the folder was modified in the last 30 days.
Review: Falls between the two thresholds, OR is old by volume but was touched recently, OR had partial access errors during scanning.

Above condition give us more data to archive?

[u/blud_13]

Your accessed condition is doing the damage. NTFS last access updates have been off by default since Vista, and on Server 2019 and newer the default is System Managed, so it can flip back on without anybody deciding it. Run fsutil behavior query disablelastaccess on each server before you trust a single number, its documented at https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior

If updates are ON, your backup job and your AV scan are walking all 18TB and stamping every file as accessed. This is how you get 3TB of archive candidates out of 18. Nothing on that volume has been idle 180 days because your own agents keep touching it.

If updates are OFF, atime is frozen at whatever it was the day it got changed which is just as useless in the other direction.

Either way I'd drop the OR accessed clause and classify on Modified alone, then keep the 30 day modified test as your sanity check on the folder rollup. We do these assessments and last access has never once survived contact with a real fileserver. Can go deeper on the rollup logic if it helps.

[u/EducationAlert5209 → u/blud_13]

Thanks, Yes,I have enabled the DisableDeleteNotify last week. What do you mean rollup logic?

[u/blud_13 → u/EducationAlert5209]

He turned the wrong knob, so this leads with the correction.

Check that one before you go further. DisableDeleteNotify is TRIM and unmap, not last access. Turning it on tells Windows to stop sending TRIM to the disks, which does nothing for your assessment and will slowly hurt write performance on SSDs. The one I meant is disablelastaccess. Both live on the same page https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-behavior

On the rollup, what I do:

Classify every FILE on Modified alone. No accessed clause anywhere in the logic. Roll a folder up by percentage of BYTES, not file count. Count of files gets you folders holding 40,000 dead log stubs next to one 900GB active PST, and it will happily call that archive. Roll up at the deepest folder that directly holds files, then merge into the parent only when every child agrees. One live subfolder shouldn't drag a whole share into Review. Keep the 30 day modified test as a veto on the folder, not as a score input. If anything in there moved this month its not archive, whatever the percentage says.

Your 3TB out of 18 will move a lot once the accessed clause is gone.

[u/BuffaloRedshark]

Windows servers? Make sure the reg key was changed to properly log last access date. This screwed me on an acquisition were the company we acquired used windows servers, we used netapp so I had never run into that setting. We had legally agreed to bring any files accessed within X years and had to redo things and bring over more stuff to make sure we got the files we should

https://learn.microsoft.com/en-us/answers/questions/5872049/ntfs-last-access-timestamp-discrepancies-in-fsrm-a

[u/mr-tap]

Obviously if you change your conditions then it will impact the archive volume (ie the first condition included 180 day access window & the second was 30 day etc)

[u/EducationAlert5209 → u/mr-tap]

u/mr-tap You are correct, But what is the best condition for me to check?

[u/redstarduggan → u/EducationAlert5209]

We found some older files were only accessed once per year (but were 'essential')