Active Directory Cookbook, 3rd Edition

Chapter 16. Backup, Recovery, DIT Maintenance, and Deleted Objects

16.0. Introduction

The AD Directory Information Tree (DIT) is implemented as a transactional database using the Extensible Storage Engine (ESE). The primary database file is named ntds.dit and is stored in the %SystemRoot%\NTDS folder by default, but can be relocated during the initial promotion process or manually via ntdsutil (see Recipe 16.12 for more details).

Each database write transaction is initially stored in a logfile called edb.log, which is stored in the same directory as ntds.dit by default, though you can modify this either during or after the initial dcpromo process. That logfile can grow to 10 MB in size, after which additional logfiles are created (e.g., edb00001.log), each of which can also grow to up to 10 MB in size. After the transactions in the logfiles are committed to the database, the logfiles are purged, beginning with the log containing the oldest transactions. (This process is referred to as circular logging.) These logfiles are useful when a domain controller is shut down unexpectedly because when the DC comes back online, Active Directory can replay the logfiles and apply any transactions that might not have been written to disk before the DC shut down. The edb.chk file stores information about the last transaction that was actually committed to the database; AD uses this information to determine which transactions in the logfiles still need to be committed. Finally, two 10 MB files called ...