Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. NTDS
FolderRisk: Do not touch
  • Windows Server

NTDS C:\Windows\NTDS

Default folder of ntds.dit, the Active Directory database, and its transaction logs on a domain controller; the location can be changed at promotion.

Updated on By AltF4 Formation

What it’s for

On a domain controller, C:\Windows\NTDS holds by default the AD DS directory database, ntds.dit, with its transaction logs. The AD DS Configuration Wizard proposes these default locations and you can change them at promotion. The folder only exists once the role is configured. Its neighbor SYSVOL carries Group Policy and scripts, not the directory.

What it contains

  • ntds.dit: the directory database (users, groups, computers, schema and password hashes).
  • The transaction logs edb*.log (the current one is edb.log), the checkpoint file edb.chk and the reserve files edbres*.jrs.
  • temp.edb and possible temporary maintenance files.
  • Sometimes none of it: the database or logs may have been placed on another volume at promotion.

Risks and best practices

  • The AD DS service keeps the database open all the time. Do not copy, move or delete anything while it runs: tampering can make the controller unusable.
  • To relocate the database, use ntdsutil (the files menu) with the controller restarted in Directory Services Restore Mode, never File Explorer.
  • Together with the SYSTEM hive, a copy of ntds.dit is enough to extract the hashes of every account in the domain. Protect backups and restrict access to this folder.
  • To back up, use a system state backup (or ntdsutil ifm for install-from-media), not a file copy.
  • Keep free space on the volume: logs that can no longer grow stop the directory.

Useful commands

Fenêtre de terminal
# Configured locations of the database and logs (on a domain controller)
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" |
  Select-Object "DSA Database file", "Database log files path", "DSA Working Directory"


# File sizes and dates
Get-ChildItem "$env:windir\NTDS" -Force | Select-Object Name, Length, LastWriteTime


# System state backup, which includes NTDS and SYSVOL (as administrator; adjust target E:)
wbadmin start systemstatebackup -backuptarget:E: -quiet


# Directory file information
ntdsutil "activate instance ntds" files info quit quit

Folder contents

Files 2

Logs 1

Report a mistake