Active Directory database file NTDS.DIT


Windows 2000 Active Directory data store, the actual database file, is %SystemRoot%\ntds\NTDS.DIT. The ntds.dit file is the heart of Active Directory including user accounts. Active Directory's database engine is the Extensible Storage Engine (
ESE ) which is based on the Jet database used by Exchange 5.5 and WINS.
The ESE has the capability to grow to 16 terabytes which would be large
enough for 10 million objects. Back to the real world. Only the Jet
database can maniuplate information within the AD datastore.

For information on domain controller configuration to optimize Active Directory, see Optimize Active Directory Disk Performance

f
The Active Directory ESE database, NTDS.DIT, consists of the following tables:

  • Schema table
    the types of objects
    that can be created in the Active Directory, relationships between
    them, and the optional and mandatory attributes on each type of object.
    This table is fairly static and much smaller than the data table.
  • Link table
    contains linked
    attributes, which contain values referring to other objects in the
    Active Directory. Take the MemberOf attribute on a user object. That
    attribute contains values that reference groups to which the user
    belongs. This is also far smaller than the data table.
  • Data table
    users, groups,
    application-specific data, and any other data stored in the Active
    Directory. The data table can be thought of as having rows where each
    row represents an instance of an object such as a user, and columns
    where each column represents an attribute in the schema such as
    GivenName.

From a different perspective, Active Directory has three types of data

  • Schema information
    definitional
    details about objects and attributes that one CAN store in the AD.
    Replicates to all domain controllers. Static in nature.
  • Configuration information
    configuration data about forest and trees. Replicates to all domain controllers. Static as your forest is.
  • Domain information
    object
    information for a domain. Replicates to all domain controllers within a
    domain. The object portion becomes part of Global Catalog. The
    attribute values (the actual bulk of data) only replicates within the
    domain.

Although GUIDs are unique, they are large. AD uses distinguished
name tag ( DNT ). DNT is a 4-byte DWORD value which is incremented when
a new object is created in the store. The DNT represents the object's
database row number. It is an example of a fixed column. Each object's
parent relationship is stored as a parent distinguished name tag ( PDNT
). Resolution of parent-child relationships is optimized because the
DNT and PDNT are indexed fields in the database. For more technical
info on the AD datastore and its organization, a good starting point is
the Active Directory Database Sizing document.

The size of ntds.dit will often be
different sizes across the domain controllers in a domain. Remember
that Active Directory is a multi-master independent model where updates
are occuring in each of the ADs with the changes being replicated over
time to the other domain controllers. The changed data is replicated
between domain controllers, not the database, so there is no guarantee
that the files are going to be the same size across all domain
controllers.

Active
Directory routinely performs online database defragmentation, but this
is limited to the disposal of tombstoned objects. The database file
cannot be compacted while Active Directory is mounted. An ntds.dit file that has been defragmented offline ( compacted ), can be much smaller than the ntds.dit file on its peers. To defrag ntds.dit offline:

  • Back up the Active Directory using Windows 2000 Backup. W2K
    backup natively supports backing up Active Directory while online. This
    occurs automatically when you select the option to back up everything
    on the computer in the Backup Wizard, or independently by selecting to
    back up System State in the backup wizard.
  • Reboot
  • Select the appropriate installation from the boot menu, and press F8 to display the Windows 2000 Advanced Options menu.
  • Choose Directory Services Restore Mode and press ENTER. Press ENTER again to start the boot process.
  • Logon using the password defined for the local Administrator account in the offline SAM.
  • Click Start, Programs, Accessories, and then click Command Prompt.
  • At the command prompt, run the ntdsutil command.
  • When ntdsutil has started
    • Type files and press ENTER.
    • Type info and then press ENTER. This will display current information about the path and size of the Active Directory database and its log files.
    • Type compact to drive:\directory, and press ENTER. Be
      sure that the drive specified has enough drive space for the compacted
      database to be created. I know, you don't know how big the compacted
      version will be, but if there is enough space for the uncompacted
      version, you should be OK. A gotcha!: You must specify a directory path and if the path name has spaces, the command will not work unless you use quotation marks

      compact to "c:\my new folder"

    • Type quit and press Enter.
    • Type quit and press Enter to return to the command prompt. A new compacted database named Ntds.dit can be found in the folder you specified.
  • Copy the new ntds.dit file over the old ntds.dit file. You
    have successfully compacted the Active Directory database. If you
    believe in belts and suspenders, I would copy the old uncompacted
    database somewhere else before I overwrote it with the new compacted
    version.
  • Reboot and see if all is normal.

This is a server by
server task. Monitor the size of ntds.dit and if it starts growing and
performance is slow and you can not see why either situation should
apply, consider offline defrags.

If ntds.dit gets corrupted or deleted or is missing ( can happen if the promotion process to domain controller goes bad ), you have to manually recover it using Windows 2000 Backup. Now you did do W2K backups right?:

  • Reboot the domain controller and press F8 to display the Windows 2000 Advanced Options menu.
  • Select Directory Services Restore Mode and then press ENTER.
  • Select the correct installation, and then press ENTER to start the boot process.
  • Logon using the administrator account and password you specified during the promotion process. When
    you ran Dcpromo.exe to install Active Directory, it requested a
    password to be used for the Administrator password for Active Directory
    Restore Mode. This password is not stored in Active Directory. It is
    stored in an NT4-style SAM file and is the only account available when
    the AD is corrupted.
  • Click OK. This acknowledges the warning message that you are using Safe mode.
  • Click Start, Programs, Accessories, System Tools, and then click Backup.
  • Select the Restore tab.
  • Click the + symbol next to the following items to expand them:
    • File
    • Media Created
    • System Drive
    • Winnt
    • NTDS
  • Click the NTDS folder to display the files in the folder.
  • Click to select the ntds.dit check box.
  • Leave the Restore files to box set to Original Location. This
    check box provides the option to restore to an alternative location. If
    you restore to an alternative location, you will have to copy the ntds.dit file into the %SystemRoot%\ntds folder.
  • Click Start Restore.

To move a database or log file :

  • Reboot the domain controller and press F8 to display the Windows 2000 Advanced Options menu.
  • Select Directory Services Restore Mode and then press ENTER.
  • Select the correct installation, and then press ENTER to start the boot process.
  • Logon using the administrator account and password you specified during the promotion process. When
    you ran Dcpromo.exe to install Active Directory, it requested a
    password to be used for the Administrator password for Active Directory
    Restore Mode. This password is not stored in Active Directory. It is
    stored in an NT4-style SAM file and is the only account available when
    the AD is corrupted.
  • Start a command prompt, and then type ntdsutil.exe .
  • At a Ntdsutil prompt, type files.
  • At the File Maintenance prompt
    • To move a database, type move db to %s
      where %s is the drive and folder where you want the database moved.
    • To move log files, type move logs to %s
      where %s is the drive and folder where you want the log files moved.
    • To view the log files or database, type info.
    • To verify the integrity of the database at its new location, type integrity.
    • Type quit
    • Type quit to return to a command prompt.
  • Restart the computer in Normal mode.

When you move the database and log files, you must back up the domain controller.

About The Author

Leave a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top