How Active Directory Stores Data | NTDS.dit, SYSVOL & Log Files Explained

 Active Directory stores all directory information in a structured database file called NTDS.dit. This file contains data about users, computers, groups, organizational units, and other network objects. It is stored on every Domain Controller and managed by the Extensible Storage Engine (ESE).

• NTDS.dit

NTDS.dit is the main Active Directory database file. It stores:

• Object data (users, computers, groups, etc.)
• Attributes (password hashes, SIDs, group memberships, etc.)
• Schema partition
• Configuration partition
• Domain partition 

By default, it is located in:

%systemroot%\NTDS

The database uses a page-based structure (8 KB pages) and supports indexing for fast searches.

•  Extensible Storage Engine (ESE)

The Extensible Storage Engine (JET Blue) is a transactional database engine.

Key features:

• Write-ahead logging
• Crash recovery
• Indexed storage
• Multi-version concurrency control

ESE ensures database integrity using transactions, meaning changes are either fully committed or rolled back.

 

• Transaction Logs (Edb.log)

Before any change is written to NTDS.dit:

1. The change is written to the log file (write-ahead logging).
2. Once safely logged, it is committed to the database.
3. The checkpoint updates.

Log files:

• Edb.log (current log file)
• Edbxxxxx.log (previous logs)
• Reserved log files (Edbres00001.jrs, Edbres00002.jrs)

These logs are critical for database recovery after unexpected shutdowns.

 

• Checkpoint File (Edb.chk)

The checkpoint file tracks:

• Which transactions have been written from memory to disk
• The last successfully committed log sequence

During start-up recovery:

• AD checks the checkpoint
• Replays any uncommitted logs
• Restores database consistency automatically

 

• SYSVOL and Group Policy Storage

While NTDS.dit stores directory objects, Group Policy templates are stored separately in SYSVOL.

Location:

%systemroot%\SYSVOL\sysvol

SYSVOL contains:

• GPO templates
• Logon scripts
• Group Policy settings

SYSVOL replication:

• FRS (legacy, deprecated)
• DFS-R (modern replication engine)

• Data Partitions in Active Directory

Active Directory uses multiple naming contexts (partitions):

1. Schema Partition
• Defines object types and attributes
• Replicates forest-wide
2. Configuration Partition
• Stores AD site and replication topology information
• Replicates forest-wide
3. Domain Partition
• Stores domain-specific objects
• Replicates only within that domain
4. Application Partitions
• Optional partitions (e.g., DNS zones)
• Replicate to selected Domain Controllers

 

• Logical Organization

Forest

└── Tree

└── Domain

└── Organizational Units

└── Objects

This hierarchy allows delegation, scalability, and administrative boundaries.

 

• Replication

Active Directory uses multi-master replication. 

Characteristics:

• Update Sequence Numbers (USNs)
• High-watermark tracking
• Knowledge consistency checker (KCC)
• Intrasite (RPC)
• Intersite (RPC or SMTP)

 

Each Domain Controller maintains:

• Invocation ID
• USN vector table
• Replication metadata per object

 

• Deleted Objects 

When an object is deleted:

1. It becomes a tombstone object.
2. Most attributes are stripped.
3. It remains for the tombstone lifetime.

Default tombstone lifetime:

• 60 days (older systems)
• 180 days (modern systems)

With Active Directory Recycle Bin enabled:

• Objects retain more attributes.
• Restoration is faster and more complete.

 

• Lingering Objects

Lingering objects occur when:

• A Domain Controller remains offline longer than the tombstone lifetime.
• Deletion updates never replicate to that Domain Controller.
• The offline DC comes back online with outdated objects.

Because the tombstone has already expired on other DCs, those DCs no longer have deletion metadata. As a result, the outdated DC keeps objects that should no longer exist.

Impact:

• Replication errors (Event ID 1988)
• Authentication inconsistencies
• Potential reintroduction of deleted security principals
• Directory divergence 

Detection:

• repadmin /replsummary
• repadmin /showrepl
• repadmin /removelingeringobjects

Prevention:

• Enable Strict Replication Consistency
• Monitor replication regularly
• Avoid keeping Domain Controllers offline beyond tombstone lifetime
• Decommission failed DCs properly (metadata clean-up)

 

• Database Maintenance and Health

Best practices:

• Regular System State backups
• Monitor NTDS database size
• Defragmentation (offline using ntdsutil)
• Ensure healthy disk subsystem
• Separate database and log files onto different disks (performance and safety)

---

Summary: 

Active Directory storage consists of:

• NTDS.dit (core directory database)
• ESE database engine
• Transaction logs for durability
• Checkpoint tracking for recovery
• SYSVOL for policy files
• Multi-master replication system
• Tombstone and Recycle Bin mechanisms
• Protection against lingering objects

 

Together, these components ensure integrity, availability, scalability, and recoverability of the Active Directory environment.

---

Subscribe to my YouTube channel: www.youtube.com/@Stack_Tech