Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. NTDS
  4. edb.log
LogRisk: Do not touch
  • Windows Server

edb.log C:\Windows\NTDS\edb.log

edb.log: current transaction log of the Active Directory database (ntds.dit), replayed after an abrupt shutdown. Binary, managed by the ESE engine.

Updated on By AltF4 Formation

What it’s for

edb.log is the current transaction log of ESE, the database engine behind ntds.dit. Every directory change is written here first, then applied to the database. After an abrupt shutdown of the domain controller, the directory service replays this log to get back to a consistent state.

What it contains

Binary transaction records, in a fixed-size file (10 MB). When edb.log is full it is renamed to a numbered log (edb00001.log and so on) and a new file takes its place. The recovery point is noted in edb.chk, alongside. The edbres00001.jrs and edbres00002.jrs files are space reserves: they let the engine finish its writes cleanly if the disk fills up.

Administrators do not read this log. For the state of the directory, the Directory Service event log is the right source.

Risks and best practices

  • Deleting, moving or editing these files leaves ntds.dit inconsistent, or even unusable.
  • Do not clean them to gain space: the engine deletes old numbered logs itself once their changes are in the database (circular logging).
  • Watch free space on the volume that holds them. A full disk stops the directory from writing.
  • To move the logs, use ntdsutil (the files menu), after a system state backup.
  • They contain directory data, so give their copies the same protection as ntds.dit.

Useful commands

Fenêtre de terminal
# Configured log location (read-only)
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' |
    Select-Object 'Database log files path'


# Logs present (name, size, date)
Get-ChildItem "$env:windir\NTDS" -Force -Filter 'edb*' | Select-Object Name, Length, LastWriteTime


# Free space on the volume
Get-Volume -DriveLetter C | Select-Object DriveLetter, SizeRemaining, Size
Fenêtre de terminal
:: Location and size of the database and log files
ntdsutil "activate instance ntds" files info quit quit

Format

Binary, specific to the ESE engine. No common administration tool reads it directly.

Rotation and archiving

The engine handles everything: it creates a numbered log when the current one is full, then deletes the old ones. No manual action is expected. The system state backup covers these logs.

How to read it

You do not. To understand the state of the directory, check the Directory Service event log, then repadmin for replication and ntdsutil for the files.

Report a mistake