ntds.dit C:\Windows\NTDS\ntds.dit

Active Directory database of a domain controller: the whole domain directory, including account secrets; it must be strictly protected.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

ntds.dit is the Active Directory Domain Services (AD DS) database. It contains the domain directory objects: users, groups, computers, linked policies, attributes and authentication data. Every domain controller holds a copy, kept current by replication. The default location is chosen in the AD DS Configuration Wizard and may differ from C:\Windows\NTDS.

What it contains

An ESE (Jet) database, accessible only to the directory service. Among other things it holds the authentication secrets (password hashes) of every account in the domain. For this reason this file and all its copies belong to the highest security tier (tier 0).

Risks and best practices

Move, rename or delete ntds.dit by hand and the domain controller no longer starts properly. Moving the database and offline defragmentation are done with ntdsutil, with the service stopped, after a backup.
The file is locked while running. To copy it, use a system state backup (Windows Server Backup, wbadmin) or a consistent snapshot.
Protect those backups like the controller itself: encryption, restricted access, controlled retention. Also limit sign-ins to domain controllers and backup and restore rights, which give access to the database.

Useful commands

# Configured location of the database and logs (read-only)
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' |
    Select-Object 'DSA Database file', 'Database log files path'

# Folder content (size and dates)
Get-ChildItem "$env:windir\NTDS" -Force | Select-Object Name, Length, LastWriteTime

# System state backup (as administrator)
wbadmin start systemstatebackup -backuptarget:E:

:: Location and size of the database and logs, as seen by ntdsutil
ntdsutil "activate instance ntds" files info quit quit

Report a mistake