NTDS.DIT Role in Windows 2000 Boot Sequence

During the startup of a Microsoft Windows 2000 Domain Controller, the NTDS.DIT file serves as the core database that transforms a standalone server into an operational Active Directory controller. This article explains how the operating system accesses, verifies, and mounts the NTDS.DIT database during boot, detailing the interaction between system processes, the Extensible Storage Engine (ESE), and the security subsystem required to enable domain authentication and directory services.

Core Function of NTDS.DIT

The NTDS.DIT (NT Directory Services - Directory Information Tree) file is the physical database storing all Active Directory objects, including users, groups, security descriptors, schema rules, and configuration partitions. On a Windows 2000 Domain Controller (DC), Windows cannot provide directory services or validate network authentication without mounting this file.

Step-by-Step Boot Sequence Execution

  1. Kernel and System Initialization
    The system boots through the standard Windows 2000 phases via NTLDR, Ntoskrnl.exe, and core driver loading. At this stage, only local boot drivers and basic subsystem components are operational.

  2. Launch of the Security Subsystem (LSASS)
    The Windows initialization process (Winlogon.exe) starts the Local Security Authority Subsystem Service (Lsass.exe). On a member server or workstation, LSASS only handles local Security Account Manager (SAM) requests. On a domain controller, LSASS is configured to initialize Active Directory.

  3. Invocation of the Directory System Agent (DSA)
    Inside the Lsass.exe process space, the system loads NTDSA.DLL (the Directory System Agent). The DSA manages Active Directory operations and interfaces directly with the database layer via the Extensible Storage Engine (Esent.dll, also known as the Jet database engine).

  4. Database Recovery and Verification
    The ESE engine reads the Windows registry to locate NTDS.DIT (stored by default in %SystemRoot%\NTDS\). Before fully opening the database:

    • The engine examines transaction logs (such as edb.log) and the checkpoint file (edb.chk).
    • If the system did not shut down cleanly, the ESE performs a "soft recovery" by replaying uncommitted transactions from the logs into NTDS.DIT.
    • The internal integrity of the schema, naming contexts, and data tables is validated.

  5. Mounting the Database and Service Advertisement
    Once integrity is confirmed, NTDS.DIT is officially mounted into memory. The DSA loads critical Active Directory components into the system cache, including the schema partition and domain configuration data.

  6. Network Service Activation
    With NTDS.DIT accessible:

    • The Kerberos Key Distribution Center (KDC) initializes using the security principals stored in the database.
    • The Netlogon service registers SRV records in DNS, advertising the server as an active domain controller ready to process logon requests and replicate with other domain controllers.

Consequences of NTDS.DIT Initialization Failure

If NTDS.DIT is missing, structurally corrupted, or locked, the ESE engine cannot complete the mount sequence. Because Active Directory cannot start, Lsass.exe generates a fatal error (typically associated with Stop code 0xc00002e1). The server halts the normal boot process, forcing an automatic reboot into Directory Services Restore Mode (DSRM) for manual database repair using utilities such as NTDSUTIL or ESENTUTL.