Using Ntdsutil Tool to Manage Active Directory

6.7K

In this post, we’ll explore how to use NTDSUTIL, some typical use case scenarios, and best practices.

What is NTDSUTIL?

NTDSUTIL is a command-line tool that is used for low-level Active Directory maintenance, recovery, and database management tasks.

Key Features of NTDSUTIL

It allows administrators to perform advanced operations such as AD database maintenance, metadata cleanup, snapshot management, and troubleshooting replication problems.

Note that you should use PowerShell or graphical tools rather than NTDSUTIL for routine management of domains, trusts, and sites.

The tool is available on all Windows Server operating systems and can be used to manage both the local and remote AD instances.

Note. Nowadays, Microsoft recommends you to use the Active Directory PowerShell module as a modern alternative to NTDSUTIL. However, you can still use NTDSUTIL effectively for advanced cases like database maintenance, snapshot management, or metadata cleanup (that don’t have PowerShell equivalent).

NTDSUTIL in Modern Active Directory Environments

NTDSUTIL remains a supported Windows Server tool for specific AD maintenance, recovery, metadata cleanup, FSMO, and database operations. However, modern AD environments include additional security and management capabilities that are not part of the NTDSUTIL workflow.

Windows Server 2025 introduces several AD enhancements (including a new AD DS functional level, improved LDAP security defaults for new deployments, LDAP channel-binding auditing, and delegated Managed Service Accounts).

When managing an enterprise AD environment, you should treat NTDSUTIL as a specialized maintenance and recovery tool rather than a general-purpose AD admin utility. For routine administration, you should use the Active Directory PowerShell module, RSAT tools, and appropriate Microsoft Entra ID/hybrid identity management tools.

Note. Windows Server 2025 introduces stronger LDAP security defaults for new AD DS deployments. LDAP signing is required by default for new deployments, while LDAP channel binding behavior should be verified in the actual environment before enforcement. you should check the effective Group Policy and registry config on the DCs rather than assuming a particular channel-binding setting. Before enforcing LDAP channel binding, don’t forget to audit existing LDAP clients for compatibility and validate the effective config on your DCs.

NTDSUTIL Typical Use Case Scenarios

NTDSUTIL is primarily used for low-level AD maintenance and recovery tasks. Typical use scenarios include:

• Offline AD database maintenance. Use the tool for offline defragmentation, compaction, and integrity checks of the ntds.dit database.
• Metadata cleanup after failed DCs. You can remove orphaned DC objects from AD.
• FSMO role transfer and seizure. With this tool, you can manage FSMO roles in both normal and failure scenarios.
• AD snapshot management. With this tool you can create and mount snapshots for offline inspection and object recovery.
• DSRM admin password reset. With NTDSUTIL, you can reset Directory Services Restore Mode admin credentials.

Best Practices Before Using NTDSUTIL

When using NTDSUTIL, it is essential to follow some best practices to ensure that the tool is used correctly and that it does not cause any adverse effects on the Active Directory environment. Here are some best practices to follow:

1. Always have a backup of the Active Directory database before performing any NTDSUTIL operations. This ensures that you can restore the AD database to its previous state in case of any errors or damage caused by the tool.
2. Understand the NTDSUTIL commands and their functions before running them. Some commands can cause significant changes to the AD environment, and you should ensure that you fully understand the effects of the command before running it.
3. Run the tool as a domain administrator or enterprise administrator account. This ensures that you have the necessary privileges to perform the required tasks.

Using NTDSUTIL to Transfer FSMO Roles

One of the primary NTDSUTIL use cases is transferring or seizing FSMO roles.

Note. In case you need to only transfer FSMO roles, it’s better to use the Active Directory PowerShell module:

Move-ADDirectoryServerOperationMasterRole -Identity "DC2" -OperationMasterRole SchemaMaster, DomainNamingMaster, RIDMaster, PDCEmulator, InfrastructureMaster

What Are FSMO Roles?

There are five FSMO Roles:

1. Schema master
2. Domain naming master
3. RID master
4. PDC emulator master
5. Infrastructure master

These roles can be assigned to different domain controllers in the forest or domain.

Steps to Transfer FSMO Roles

Note. Before transferring FSMO roles, verify the Domain and Forest Functional Levels to ensure the target domain controller meets the requirements. The target DC must run a Windows Server version that is equal to or higher than the current functional level. To check the current functional levels, run:

# Check Forest Functional Level
Get-ADForest | Select-Object ForestMode

# Check Domain Functional Level
Get-ADDomain | Select-Object DomainMode

Before continuing, you should verify if Active Directory replication is healthy:

repadmin /replsummary

First, determine which server currently holds the FSMO roles.

netdom query fsmo

In this example, all the FSMO roles are owned by the DC1.theitbros.local server.

Suppose you need to transfer the FSMO roles to another DC, such as DC2.theitbros.local; follow these steps:

1. Log in to any domain controller and open CMD or PowerShell as admin.
2. Run the below commands in sequence to enter the fsmo maintenance mode:
   

   ntdsutil 
   
   roles 
   
   connections

3. On the server connections prompt, enter the following command. In this example, DC2 is the target domain controller server name:
   

   connect to server DC2 
   
   quit

   
4. You’re back to the fsmo maintenance prompt. To transfer the FSMO roles, run the below commands one at a time:
   

   transfer schema master 
   
   transfer naming master 
   
   transfer rid master 
   
   transfer pdc 
   
   transfer infrastructure master

5. Each command will ask you to confirm the transfer operation. Click Yes.
   

   

6. In the end, DC2 will be the new owner of the FSMO roles:
   

   

7. Finally, confirm the new FSMO role owner:
   

   netdom query fsmo

   

   You’ve successfully used NTDSUTIL to transfer the FSMO role owner.

Seizing FSMO Roles Using NTDSUTIL

In case the DC that holds an FSMO role has permanently failed and cannot be brought back online, you can seize the role and assign it to another DC.

Important. Keep in mind that FSMO seizure is a recovery operation, not a normal method of transferring roles. You should use it only when the current role holder is unavailable and you do not plan to return that DC to the AD environment. In case the original role holder can be brought back online, you need to transfer the role instead. We recommend using seizure with extreme caution because it bypasses the normal sync and graceful transfer process.

Before seizing an FSMO role, you should verify the current role holders and make sure the target DC is healthy:

netdom query fsmo
repadmin /replsummary

In case the failed DC cannot be recovered, log on to a healthy DC and start NTDSUTIL:

ntdsutil
roles
connections
connect to server DC2
quit

You need to replace DC2 with the name of the healthy DC that should become the new FSMO role holder.

At the fsmo maintenance prompt, use the appropriate seize command:

seize schema master
seize naming master
seize rid master
seize pdc
seize infrastructure master

You do not normally need to seize all five roles. Seize only the roles that were held by the failed DC.

Now confirm the new FSMO role holders using the command below:

netdom query fsmo

After the seizure, do not bring the old DC back into the domain as if nothing happened. If the failed DC is permanently lost, you need to perform metadata cleanup and follow the appropriate DC replacement/recovery procedure.

For routine role moves where the current FSMO role holder is available, you need to use a normal transfer instead of seizure.

Using NTDSUTIL to Reset the Administrator Password for the DSRM

NTDSUTIL can be used to change the Directory Services Restore Mode (DSRM) administrator account password, which is used to restore Active Directory in case of a disaster. Here’s how to use NTDSUTIL for this scenario:

1. To launch NTDSUTIL, open a command prompt or PowerShell with administrative privileges, type ntdsutil, and press Enter.
2. Type set dsrm password and press Enter.
3. Type reset password on server TargetDCName and press Enter, replacing TargetDCName with the domain controller name you want to change the password on.
4. Type the new password for the DSRM administrator account and press Enter, then confirm the password by typing it again and pressing Enter.
5. Type q and press Enter to exit the set dsrm password context.
6. Type q and press Enter again to exit NTDSUTIL.
   

   

Using NTDSUTIL to Maintain Active Directory Database

NTDSUTIL can be used to manage the Active Directory database, including compacting, defragmenting, and repairing the database.

Note. The following tasks require that the AD database on the server is offline, so do this only during a planned maintenance window.

Boot the Domain Controller into DSRM

Before performing offline maintenance of the ntds.dit database, you need to boot the DC into Directory Services Restore Mode (DSRM). In DSRM, Active Directory Domain Services is not running, so the ntds.dit database is not being used by the directory service.

Restart the DC and select Directory Services Restore Mode from the Windows recovery/startup options. Sign in using the DSRM admin account and password.

Important. While the DC is in DSRM, it cannot provide normal AD services such as LDAP and Kerberos authentication. If the DC also provides DNS or other infrastructure services, those services may also be unavailable from that server. You need to ensure that another DC can provide these services before taking a production DC offline.

Once the server is running in DSRM, you can start ntdsutil and perform the offline database operation. You do not need to manually stop Kdc, IsmServ, DNS, DFSR, and NTDS before starting the procedure.

Compacting an Active Directory Database

The online defragmentation happens automatically every 12 hours. This task reorganizes the data in the database and can improve its performance.

But, online defragmentation does not reduce the database file size. When the database size grows large, it may cause performance issues, so periodically compacting the database should be on your maintenance list.

1. In the elevated PowerShell prompt, type ntdsutil and press Enter.
2. Type activate instance ntds and press Enter.
3. Type files and press Enter.
4. After entering the file maintenance context, type compact to C:\temp\ntds\newdb.dit and press Enter. This command creates a new, smaller version of the database in the specified temporary location. Once the compact database process starts, you must wait for it to finish. The duration depends on how large the database is.
   Offline defragmentation creates a new, compacted copy of the Active Directory database. It does not automatically replace the existing ntds.dit. Before running compact to, make sure the target directory exists. For example:

   New-Item -ItemType Directory -Path C:\temp\ntds -Force

   

5. Before replacing the existing database, you should check the integrity of the compacted database:
   

   esentutl /g "C:\temp\ntds\newdb.dit"

   Continue only if the integrity check completes successfully.

6. In case the integrity check succeeds, you need to preserve a current System State backup before replacing the existing database. Then complete the database replacement according to Microsoft’s documented procedure, including removing the old transaction logs and copying the compacted Ntds.dit over the original database file.

Analyzing and Repairing Active Directory Database Corruption

In case you suspect AD database corruption, first you need to perform a semantic database analysis in order to identify inconsistencies. Do not run go fixup as a routine troubleshooting/maintenance step.

go fixup is a last-resort recovery operation. It can modify/remove directory data identified as inconsistent by the semantic checker. Because the operation can result in data loss, you should use it only when other supported recovery options are unavailable and preferably with Microsoft Support/experienced AD recovery specialist involved.

Before proceeding, you need to ensure that you have a valid, recent System State backup and a documented recovery plan. In case another healthy DC is available, consider if rebuilding the affected DC/restoring it from a supported backup is safer than performing a lossy repair.

1. Boot the DC into Directory Services Restore Mode (DSRM) and log on with the DSRM admin credentials.
2. Start ntdsutil.
3. Enter the semantic checker:

   semantic database analysis

   
4. Run the analysis only:

   go

Review the generated report and determine whether the reported inconsistencies require corrective action.

You should not proceed directly to go fixup simply because the semantic analysis reports errors. Determine the appropriate recovery method based on the type of corruption, available DCs, replication health, and available System State backups.

Start Services

Once you’ve completed the database maintenance, you can return the AD database online by starting the required services.

# Start the services 
Start-Service -Name NTDS, Kdc, IsmServ, DNS, DFSR 
# List the status of the services 
Get-Service -Name Kdc, IsmServ, DNS, DFSR, NTDS

Using NTDSUTIL to Manage Active Directory Snapshots

NTDSUTIL can be used to create and manage snapshots of Active Directory, which can be used to recover deleted objects or restore Active Directory to a previous state.

Creating a Snapshot with NTDSUTIL

1. In the elevated PowerShell prompt, type ntdsutil and press Enter.
2. Type activate instance ntds and press Enter.
3. To create a snapshot of Active Directory, type snapshot and press Enter.
4. Type create and press Enter. This command creates a new snapshot of Active Directory.
5. Now, list all available snapshots by running list all. As you can see, the new snapshot was created. Take note of the GUID and position number of that snapshot.
   

   

Mount a Snapshot and Recover Deleted Object Info

After you’ve created a snapshot, you can mount it and browse its contents to recover deleted objects. And in this scenario you won’t need to restore the whole Active Directory.

Mounting the Snapshot

At first, mount the snapshot by its position number:

mount 1

Now take a note of the GUID that has returned, we will use it in the next step. GUID looks like this:

{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

Now type q twice, that will exit the NTDSUTIL.

Exposing the Snapshot via DSAMAIN

Now open a new elevated PowerShell and run the following command:

dsamain -dbpath "C:\$SNAP_<GUID>_VOLUMEC$\Windows\NTDS\ntds.dit" -ldapport 50000

Here you need to replace <GUID> with the actual GUID which you noted on the previous step. That will expose snapshot as read-only LDAP instance on port 50000.

Browsing and Recovering Objects

After mounting the snapshot and exposing it through dsamain, you can use AD tools to inspect objects and retrieve their attributes from the read-only snapshot. For example, you can search for a user in the snapshot:

Get-ADUser `
-Server "DC2:50000" `
-Identity "jdoe" `
-Properties *

You can also search for objects and inspect their attributes:

Get-ADObject `
-Server "DC2:50000" `
-Filter 'SamAccountName -eq "jdoe"' `
-Properties *

The snapshot is read-only. You can’t use Restore-ADObject to copy an object from an AD snapshot back into the production directory. Microsoft documents Restore-ADObject for restoring deleted directory objects, and the cmdlet does not work with AD snapshots. In case an object must be recovered from a snapshot, you should use the snapshot to inspect and extract the required object attributes, then recreate/restore the object in the production directory using an appropriate recovery procedure.

Unmounting the Snapshot

When it’s done, you need to stop the dsamain process and unmount the snapshot using NTDSUTIL tool:

ntdsutil
snapshot
unmount 1
delete 1
q
q

Note. You should note that snapshots consume disk space, so it’s better to delete them after finishing tasks.

Using NTDSUTIL to Remove a Failed Domain Controller

When a domain controller fails and cannot be brought online again, you must ensure to clean it up from the environment. You can use NTDSUTIL to remove a failed domain controller.

There are several steps involved, which can be confusing, so make sure to follow the instructions carefully.

1. Log in to a domain controller and open a PowerShell window as admin.
2. Type ntdsutil and press Enter.
3. Type metadata cleanup and press Enter.
4. Type connections and press Enter.
5. Type connect to server servername and press Enter. Replace servername with the name of the online/healthy domain controller.
6. Type q and press Enter:
   

   

7. Type select operation target and press Enter.
8. Type list domains and press Enter. Note the domain to which the failed DC belongs. In this example, there’s only one domain.
9. Type select domain %s and press Enter. Replace %s with the domain name identified in the previous step.
   

   

10. Type list sites and press Enter. Note the site to which the failed DC belongs.
11. Type select site %s and press Enter. Replace %s with the position or name of the site to which the failed DC belongs. In this example, there is only one site.
    

    

12. Type list servers in site and press Enter. Note the name of the failed DC.
13. Type select server %s and press Enter. Replace %s with the position number or name of the failed DC. In this example, the failed DC is DC2, which is in position 1.
14. Type quit and press Enter.
    

    

15. Type remove selected server and press Enter.
16. When asked to confirm, click Yes to confirm the removal of the failed DC.
    

    

17. Type quit and press Enter.
18. Type quit again and press Enter to exit Ntdsutil.
    

    

Removing a failed DC using ntdsutil requires careful attention to detail, as any mistakes can have serious consequences for your Active Directory environment. Therefore, it is recommended that you follow these instructions closely and seek assistance from an experienced Active Directory administrator if you have any doubts or concerns.

Wrapping Up

NTDSUTIL is a powerful command-line tool that allows Windows Server administrators to manage Active Directory and its related components. The tool is designed for advanced Active Directory maintenance and recovery scenarios, such as database operations, metadata cleanup, and disaster recovery tasks.

But, due to its power, it is essential to follow best practices and be aware of the cautions when using the tool to ensure that it is used correctly and does not cause any adverse effects on the Active Directory environment.