• Home
• About
• Animals and Rescues
• Computer Issues
• Computer parts
• Computer parts install instructions
• Contact
• Definitions
• DOS Commands
• Downloads
• Hardware questions
• How to use software
• How to use Windows
• How to perform tasks and other information
• Humor
• Internet info and help
• Madison High School Yearbooks
• Madison High School Alumni and teacher's deaths
• Military reunions, events and other info
• How to use Microsoft Office
• Network setup, and other info
• Information on operating systems
• Reinstall operating system
• Remote Services
• Service cost           
• Safety Tips
• Tips
• Troubleshooting Tools
• Info on Websites and/or Businesses
• 
  I have put this website up for your convenience.  The website and email service is free, but if you find this site helpful and would like to make a donation, click on the donate button above. Thank you!
  

NTDsutil 

This page is from Microsoft

Updated: January 21, 2005

addlink

Ntdsutil.exe is a command-line tool that provides management facilities for Active Directory. Use Ntdsutil.exe to perform database maintenance of Active Directory, manage and control single master operations, and remove metadata left behind by domain controllers that were removed from the network without being properly uninstalled. This tool is intended for use by experienced administrators.

To view the command syntax, click a command:

• Authoritative restore
• Configurable settings
• Domain management
• Files
• LDAP policies
• Metadata cleanup
• Roles
• Security account management
• Semantic database analysis
• Set DSRM Password
• Group membership evaluation

Authoritative restore

Syntax

Parameters

Remarks

• When you are restoring a domain controller by using backup and restore programs, such as Ntbackup or those from other providers, the default mode for the restore is nonauthoritative. This means that the restored server is brought up to date with its replicas through the normal replication mechanism. For example, if a domain controller is restored from a backup tape that is two weeks old, when you restart it, the normal replication mechanism brings it up to date with respect to its replication partners.
• You might need to perform an authoritative restore if an administrator inadvertently deletes an organizational unit containing a large number of users. If you restore the server from tape, the normal replication process would not restore the inadvertently deleted organizational unit. Authoritative restore allows you to mark the organizational unit as authoritative and force the replication process to restore it to all of the other domain controllers in the domain.

Return to Top

 

Configurable settings

Syntax

Parameters

Return to Top

 

Domain management

Syntax

Parameters

Return to Top

 

Files

Syntax

Parameters

• Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Remarks

• Active Directory is implemented on top of an indexed sequential access method (ISAM) table manager. This is the same table manager used by Microsoft Exchange Server, the file replication service, the security configuration editor, the certificate server, Windows Internet Name Service (WINS), and other Windows components. The version of the database that Windows 2000 and Windows Server 2003, Standard Edition use is called extensible storage engine (ESENT).

  ESENT is a transacted database system that uses log files to support rollback semantics to ensure that transactions are committed to the database. Ideally, data and log files should be located on separate drives to improve performance and support recovery of the data if a disk fails.

• ESENT provides its own tool for certain database file management functions called Esentutl.exe, which is also installed in the systemroot\System32 folder. Several of the Ntdsutil file management commands invoke Esentutl, reducing the need to learn the tool's command-line arguments. In the cases where Ntdsutil invokes Esentutl, it brings up a separate window configured with a large history so that you can scroll back to see all of the Esentutl progress indicators.

  Active Directory opens its files in exclusive mode. This means the files cannot be managed while the system is operating as a domain controller.

  To manage directory service files

1. Start the computer.
2. When the Starting Windows progress bar appears, press F8.
3. From the Windows 2000 Advanced Options Menu, select Directory Services Restore Mode.

Note

• Starting the computer in Directory Services Restore Mode causes your domain controller to temporarily operate as a stand-alone server. This causes some services to fail, especially those that are integrated with the directory service. When operating in this mode, the security accounts manager (SAM) uses a minimal set of user and group definitions stored in the registry. If your domain controller is not physically secure, you should set the administrative password for the Directory Services Restore Mode.

Return to Top

 

LDAP policies

Syntax

Parameters

Remarks

• The following table lists and describes the LDAP administration limits, with default values noted in parentheses.

  Value	Description
  InitRecvTimeout	Initial receive time-out (120 seconds)
  MaxConnections	Maximum number of open connections (5000)
  MaxConnIdleTime	Maximum amount of time a connection can be idle (900 seconds)
  MaxActiveQueries	Maximum number of queries that can be active at one time (20)
  MaxNotificationPerConnection	Maximum number of notifications that a client can request for a given connection (5)
  MaxPageSize	Maximum page size supported for LDAP responses (1000 records)
  MaxQueryDuration	Maximum length of time the domain controller can execute a query (120 seconds)
  MaxTempTableSize	Maximum size of temporary storage allocated to execute queries (10,000 records)
  MaxResultSetSize	Maximum size of the LDAP Result Set (262144 bytes)
  MaxPoolThreads	Maximum number of threads created by the domain controller for query execution (4 per processor)
  MaxDatagramRecv	Maximum number of datagrams that can be processed by the domain controller simultaneously (1024)

• To ensure that domain controllers can support service level guarantees, you need to specify operational limits for a number of Lightweight Directory Access Protocol (LDAP) operations. These limits prevent specific operations from adversely impacting the performance of the server and also make the server resilient to denial of service attacks.

  LDAP policies are implemented by using objects of the class queryPolicy. Query Policy objects can be created in the container Query Policies, which is a child of the Directory Service container in the configuration naming context. For example: CN=Query-Policies, CN=Directory Service, CN=Windows NT, CN=Services (configuration directory partition).

  A domain controller uses the following three mechanisms to apply LDAP policies:

  • A domain controller might refer to a specific LDAP policy. The nTDSASettings object includes an optional attribute queryPolicyObject, which contains the distinguished name of a Query Policy.
  • In the absence of a specific query policy being applied to a domain controller, the domain controller applies the Query Policy that has been assigned to the domain controller's site. The ntDSSiteSettings object includes an optional attribute queryPolicyObject, which contains the distinguished name of a Query Policy.
  • In the absence of a specific domain controller or site Query Policy, a domain controller uses the default query policy named Default-Query Policy.
  • A Query Policy object includes the multivalued attributes LDAPIPDenyList and LDAPAdminLimits. Ntdsutil allows the administrator to set the LDAP administration limits and IP Deny list for the Default-Query Policy object.

Return to Top

 

Metadata cleanup

Syntax

Parameters

• When you use the version of Ntdsutil.exe that is included with Windows Server 2003 SP1, you can remove server metadata by using the remove selected server %s or remove selected server %s on %2 commands without first using the Server connections and Select operation target submenus.

Remarks

• The directory service maintains various metadata for each domain and server known to the forest. Normally, domains and domain controllers are created by means of promotion using the Active Directory Installation Wizard and are removed by means of demotion using the same tool. You can invoke the Active Directory Installation Wizard by typing dcpromo at the command prompt.

  Promotion and demotion are designed to correctly clean up the appropriate metadata. In the directory, however, you might have domain controllers that were decommissioned incorrectly. In this case, their metadata is not cleaned up. For example, a domain controller has failed, and rather than attempting to restore it, you decide to retire the server. This leaves some information about the retired domain controller in the directory. The general model of operation is to connect to a server known to have a copy of the offending metadata, select an operation target, and then delete the metadata of the selected target. The version of Ntdsutil.exe that is included with Windows Server 2003 SP1 can automatically connect to a specified server and remove metadata for a specified target in the same step.

  Caution

  • Do not delete the metadata of existing domains and domain controllers.

Roles

Syntax

Parameters

Remarks

• Although Active Directory is based on a multimaster administration model, some operations support only a single master. For multimaster operations, conflict resolution ensures that after the system finishes replicating, all replicas agree on the value for a given property on a given object. However, some data, for which adequate conflict resolution is not possible, is key to the operation of the system as a whole. This data is controlled by individual domain controllers called operations masters. These domain controllers are referred to as holding a particular operations master role.

  Following are the five operations master roles, some are enterprise-wide and some are per domain:

  • Schema Operations Master. There is a single schema operations master role for the entire enterprise. This role allows the operations master server to accept schema updates. There are other restrictions on schema updates.
  • Relative ID Master. There is one relative ID master per domain. Each domain controller in a domain has the ability to create security principals. Each security principal is assigned a relative ID. Each domain controller is allocated a small set of relative IDs out of a domain-wide relative ID pool. The relative ID master role allows the domain controller to allocate new subpools out of the domain-wide relative ID pool.
  • Domain-Naming Master. There is a single domain-naming master role for the entire enterprise. The domain-naming master role allows the owner to define new cross-reference objects representing domains in the Partitions container.
  • PDC Operations Master. There is one primary domain controller (PDC) operations master role per domain. The owner of the PDC operations master role identifies which domain controller in a domain performs Windows NT 4.0 PDC activities in support of Windows NT 4.0 backup domain controllers and clients using earlier versions of Windows.
  • Infrastructure Master. There is one infrastructure master role per domain. The owner of this role ensures the referential integrity of objects with attributes that contain distinguished names of other objects that might exist in other domains. Because Active Directory allows objects to be moved or renamed, the infrastructure master periodically checks for object modifications and maintains the referential integrity of these objects.
• An operations master role can only be moved by administrative involvement; it is not moved automatically. Additionally, moving a role is controlled by standard access controls. Thus a corporation should tightly control the location and movement of operations master roles. For example, an organization with a strong IT presence might place the schema role on a server in the IT group and configure its access control list (ACL) so that it cannot be moved at all.

  Operations master roles require two forms of management: controlled transfer and seizure.

  Use controlled transfer when you want to move a role from one server to another, perhaps to track a policy change with respect to role location or in anticipation of a server being shut down, moved, or decommissioned.

  Seizure is required when a server that is holding a role fails and you do not intend to restore it. Even in the case of a server recovered from a backup, the server does not assume that it owns a role (even if the backup tape says so), because the server cannot determine if the role was legitimately transferred to another server in the time period between when the backup was made and the server failed and was recovered. The restored server assumes role ownership only if a quorum of existing servers is available during recovery and they all agree that the restored server is still the owner.

  The Roles submenu in Ntdsutil is used to perform controlled transfer and recovery of operations master roles. Controlled transfer is simple and safe. Because the source and destination servers are running, the system software guarantees that the operations master role token and its associated data is transferred atomically. Operations master role seizure is equally simple but not as safe. You simply tell a particular domain controller that it is now the owner of a particular role.

  Caution

  • Do not make a server a role owner by means of seizure commands if the real role holder exists on the network. Doing this could create irreconcilable conflicts for key system data. If an operations master role owner is temporarily unavailable, do not make another domain controller the role owner. This could result in a situation where two computers function as the role owner, which might cause irreconcilable conflicts for key system data.

Return to Top

 

Security account management

Syntax

Parameters

Remarks

• Each security account (users, groups, and computers) is identified by a unique security identifier (SID). Use a SID to uniquely identify a security account and to perform access checks against resources, such as files, file directories, printers, Exchange mailboxes, Microsoft SQL server databases, objects stored in Active Directory, or any data that is protected by the Windows Server 2003, Standard Edition security model.

  A SID is made up of header information and a set of relative identifiers that identify the domain and the security account. Within a domain, each domain controller is capable of creating accounts and issuing each account a unique security identifier. Each domain controller maintains a pool of relative IDs that is used in the creation of security identifiers. When 80 percent of the relative ID pool is consumed, the domain controller requests a new pool of relative identifiers from the relative ID operations master. This ensures that the same pool of relative IDs is never allocated to different domain controllers and prevents the allocation of duplicate security identifiers. However, because it is possible (but rare) for a duplicate relative ID pool to be allocated, you need to identify those accounts that have been issued duplicate security identifiers so that you prevent undesirable application of security.

  One cause of duplicate relative ID pools is when the administrator seizes the relative ID master role while the original relative ID master is operational but temporarily disconnected from the network. In normal practice, after one replication cycle, the relative ID master role is assumed by just one domain controller, but it is possible that before the role ownership is resolved, two different domain controllers might each request a new relative ID pool and be allocated the same relative ID pool.

Return to Top

 

Semantic database analysis

Syntax

Parameters

Remarks

• Unlike the file management commands described earlier, which test the integrity of the database with respect to the ESENT database semantics, the semantic analysis analyzes the data with respect to Active Directory semantics. It generates reports on the number of records present, including deleted and phantom records.

  Note

  • End users should not use this command except when Microsoft requests them to use it as an aid to fault diagnosis.

Set DSRM Password

Syntax

Parameters

Remarks

• The DSRM password on a domain controller is initially set when the Active Directory Installation Wizard (Dcpromo) is run on a server to promote it to a domain controller.
• If the domain controller is in directory services restore mode, you cannot reset the DSRM password on a domain controller using ntdsutil.

Return to Top

Group membership evaluation

Return to Top

• By default, Ntdsutil.exe is installed in the systemroot\System32 folder. For more information about Ntdsutil.exe, see Using Ntdsutil .
• If the variable has spaces in it, enclose it in parentheses, instead of quotation marks, as follows:

  connect to server (xxx yyy)

   

Formatting legend