The NTDSutil.exe utility is one of the key tools to manage Active Directory and its database (ntds.dit file).
The NTDSutil utility can be used by AD administrators in various scenarios. Most often the utility is used to:
- Transfer (seizing) FSMO roles in the AD domain between domain controllers;
- Authoritative restoring of deleted objects in Active Directory;
- Remove faulty (missing) AD domain controllers;
- Performing AD database maintenance: checking integrity, compressing, moving the ntds.dit file or AD log files to another drive on a domain controller in order to increase performance;
- Active Directory snapshot management;
- Change the administrator password for the DSRM (Directory Services Restore Mode) recovery mode.
To display the basic syntax of the NTDSutil utility, open an elevated command prompt on the domain controller and run:
Ntdsutil.exe /?
As you can see, the Ntdsutil utility has a few subcommands available. Let’s try to learn them in more detail with examples.
Let me remind you that in the AD there are five FSMO (Flexible Single Master Operation) roles:
These roles can be assigned to different domain controllers in the AD forest and/or domain. The current owners of FSMO roles can be obtained using the command:
netdom query fsmo
source link: https://theitbros.com/ntdsutil/
Home