Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. NTDS
  4. edb.chk
FileRisk: Do not touch
  • Windows Server

edb.chk C:\Windows\NTDS\edb.chk

edb.chk: the ESE checkpoint file of the Active Directory database; it marks the last log whose transactions are written to ntds.dit.

Updated on By AltF4 Formation

What it’s for

The Active Directory ESE engine writes each transaction to the edb.log log first and to ntds.dit later. edb.chk records how far that catch-up has gone: after an abrupt shutdown, the engine only replays the logs located after the checkpoint. The file is tiny and updated constantly.

What it contains

A binary structure: the log number and position from which recovery starts. It is not human-readable, but esentutl decodes it. Its location follows that of the logs, set by the Database log files path value under HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters.

Risks and best practices

  • It forms a set with ntds.dit and the edb*.log logs. Never copy it alone from another controller or an old backup: back up and restore the full System State.
  • Do not delete it to “unstick” a controller that will not start. Use ntdsutil or esentutl /g on a working copy, or restore.
  • The file is locked while the Active Directory service runs: inspect it only on a copy or after stopping the service.

Useful commands

Fenêtre de terminal
:: Decode the checkpoint (on a copy, or with the service stopped)
esentutl /mk C:\Temp\copy\edb.chk


:: Locations and sizes of the database and logs (as administrator)
ntdsutil "activate instance ntds" files info quit quit
Fenêtre de terminal
# Configured location of the logs
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' | Select-Object 'Database log files path', 'DSA Working Directory'

Report a mistake