Mastering Active Directory

Integrity checking to detect low-level database corruption

By running an integrity check, we can identify binary-level database corruption. This comes as part of the Ntdsutil tool which is used for AD database maintenance. This goes through every byte of the database file. The integrity command also checks whether the correct headers exist in the database itself and whether all of the tables are functioning and consistent. This process also runs as part of Active Directory Service Restore Mode (DRSM).

This check needs to be run with the NTDS service off.

In order to run an integrity check, use the following steps:

1. Log in to DC as Domain/Enterprise Admin.
2. Open PowerShell as an administrator.
3. Stop the NTDS service using net stop ntds.