Recipe 16.9 Repairing or Recovering the DIT

16.9.1 Problem

You need to repair or perform a soft recovery of the Active Directory DIT because a power failure or some other failure caused the domain controller to enter an unstable state.

16.9.2 Solution

16.9.2.1 Using a command-line interface

First, reboot into DS Restore Mode.

Run the following command to perform a soft recovery of the transaction log files:

> ntdsutil files recover q q

If you continue to experience errors, you may need to run a repair, which does a low level repair of the database, but can result in loss of data:

> ntdsutil files repair q q

If either the recover or repair are successful, you should then check the integrity (see Recipe 16.7).

16.9.3 Discussion

You should (hopefully) never need to recover or repair your Active Directory database. A recovery may be needed after a domain controller unexpectedly shuts down, perhaps due to a power loss, and certain changes were never committed to the database. When it boots back up, a soft recovery is automatically done in an attempt to reapply any changes contained in the transaction log files. Since Active Directory does this automatically, it is unlikely that running the ntdsutil recover command will be of much help. The ntdsutil repair, on the other hand, can fix low-level problems, but it can also result in a loss of data, which cannot be predicted. USE AT YOUR OWN PERIL!

I recommend you use extreme caution when performing a repair, and you may want to engage Microsoft Support first in case something really bad goes wrong. If you try the repair and it makes things worse, you should consider rebuilding the domain controller from scratch. See Recipe 3.6 for forcibly removing a domain controller.

16.9.4 See Also

Recipe 16.2 for booting into Directory Services Restore Mode, Recipe 16.7 for checking the integrity of the DIT, and MS KB 315131 (HOW TO: Use Ntdsutil to Manage Active Directory Files from the Command Line in Windows 2000)