The AD Directory Information Tree (DIT) is implemented as a transactional database using the Extensible Storage Engine (ESE). The primary database file is named ntds.dit and is stored in the %SystemRoot%\NTDS folder by default, but can be relocated during the initial promotion process or manually via ntdsutil (see Recipe 16.12 for more details).
Each database write transaction is initially stored in a logfile
called edb.log, which is stored in
the same directory as ntds.dit by default, though you
can modify this either during or after the initial
dcpromo process. That logfile can grow to 10 MB
in size, after which additional logfiles are created (e.g.,
edb00001.log), each of which can also grow to up to
10 MB in size. After the transactions in the logfiles are committed to the
database, the logfiles are purged, beginning with the log containing the
oldest transactions. (This process is referred to as circular
logging.) These logfiles are useful when a domain controller is
shut down unexpectedly because when the DC comes back online, Active
Directory can replay the logfiles and apply any transactions that might
not have been written to disk before the DC shut down. The edb.chk file stores information about the last transaction that was actually committed to the database; AD uses this information to determine which transactions in the logfiles still need to be committed. Finally, two 10 MB files called ...