De fragmentation

In a windows 2003 environment, if you low on disk space, or if you have deleted a lot of objects since you promote your DC. You should perform an offline degragmentation to the DIT file. As you might know, there are two type of defragmentation in windows 2003 family,
- online Defragmentation
- offline Defragmentation

Online Defragmentation

By default in windows 2003, the online defrag process runs every 12 hours on each domain controller. This process defrags the Active Directory database (ntds.dit) by combining whitespace generated from deleted objects, but does not reduce the size of the database file.
you can check the Directory Event log to see when the last online defrag was performed. See Figure-1 for NTDS online Defrag Event 700 (Online Defrag start) in Directory Service log indicates the online Defrag has started.

Figure-1 NTDS online Defrag Event 700 (Online Defrag started)

upon completion of Online defrag, an event number 701 is logged. See Figure-2

Figure-2 NTDS online Defrag Event 701 (Online Defrag Ended)

You can also manually start the online Defrag, here is how:
1. Start => Run => "LDP" to start up LDP
2. Select Connection => Connect, enter name of Domain controller with Default Port 389
3. Connection => bind, then enter admin credential

Figure-3 Bind with Admin Credential
4. Browse => Modify,
   - Leave DN Blank
   - For Attribute, enter " DoOnlineDefrag"
   - Value enter Maximum time(SEC) the defrag should run, here we use  180
   - For Operation, choose Add,
   - click enter

Figure-4 Add DoOnlineDefrag Attribute to trigger the online Defrag
5. click Run

Offline Defragmentation

Beside online defragmentation which is performed automatically at default interval of 12 Hours as part of Windows Maintenance(Garbage Collection), offline defragmentation create compacted version of database file which in most case will be considerably smaller. here is how you can start offline defrag:
1. you need to first reboot the server into DS restore mode, please see "How to perform a Nonauthoritative Restore to Domain Controller? "  for more detail on how to boot to DS Restore mode.
2. Check Directory Integrity, detail see "How to check Active Directory database integrity(DIT File's Integrity)? "
3.  Open up command prompt and type ntdsutil
4. goto files menu
5. issue command " compact to C:\TempFolder, you can use single command too:
ntdsutil files "compact to P:\TempFolder"
See Figure-5 for output of compact subcommand

Figure-5 Compact to C:\TempFolder output
6. next you need to delete the Transcation Log files in the current NTDS directory.
   del C:\WINDOWS\NTDS\*.log 
7. Next to move the dit file in the temperory folder to original directory, it's recommended to rename the original DIT file and store in the temperory location to ensure nothing "Strange" happened to compacted DIT.
Below command is to move and rename the older DIT file to the temp folder
move c:\WINDOWS\NTDS\ntds.dit P:\TempFolder\ntds_old.dit
next, move new ntds.dit file to windows\ntds directory:
move P:\TempFolder\ntds.dit C:\WINDOWS\NTDS\ntds.dit
8. Now we need to run another integrity check of DIT file.(refer to step 2)

good backup

 

When to Restore

When an object is deleted in Windows 2008R2, the DC from which the object was deleted 

informs the other DCs in the environment about the deletion by replicating what is known as a 

tombstone(if the recycle bin isn’t enabled) or Deleted (with recycle bin). 

A tombstone or deleted object is a representation of an object that has been deleted from the 

directory. The tombstone object is removed by the garbage collection processes, based on the 

tombstone lifetime setting, which by default is set to 180 days by default in Windows 2008R2.

A Deleted object will be recycled after the “Recycle object lifetime”, which is by default equal to 

the tombstone lifetime, or 180 days in Windows 2008R2.

A backup older than the tombstone lifetime set in Active Directory is not considered to be a 

good backup.

Active Directory protects itself from restoring data older than the tombstone lifetime. For 

example, let’s assume that we have a user object that is backed up. If after the backup the 

object is deleted, a replication operation is performed to the other DCs and the object is 

replicated in the form of a tombstone.  After 180 days, all the DCs remove the tombstone as part 

of the garbage collection process. This is a process routinely performed by DCs to clean up their 

copy of the database. 

If you attempt to restore the deleted object after 180 days, the object cannot be replicated to 

the other DCs in the domain because it has a USN that is older than the level required to trigger 

replication. And the other DCs cannot inform the restored DC that the object was deleted, so the 

result is an inconsistent directory.