NTDS

Res1.logs Res2.log: This is reserved transaction log files of 20 MB (10 MB each) which provides the transaction log files enough room to shutdown if the other spaces are being used.

Garbage Collection: is a process that is designed to free space within the Active Directory database. This process runs independently on every DC with a default lifetime interval of 12 hours.

★ Removing “tombstones” from the database. Tombstones are remains of objects that have been
previously deleted.
★ Deletion of any unnecessary log files.
★ The process launches a defragmentation thread to claim additional free space.

Online Defragmentation: method that runs as part of the garbage collection process. The only
an advantage to this method is that the server does not need to be taken offline for it to run. However, this method does not shrink the Active Directory database file (Ntds.dit).

Offline Defragmentation: is done by taking the server offline and use Ntdsutil.exe to defragment the
database. This approach requires that the ADS database be started in repair mode. The advantage to this method is that the database is resized, unused space is removed, and the size is reflected by the Ntds.dit file.

Active Directory routinely performs online database defragmentation, but this is limited to the disposal of tombstoned objects. The database file cannot be compacted while Active Directory is mounted. To defrag ntds.dit offline:
★ Back up System State in the backup wizard.
★ Reboot and select Directory Services Restore Mode.
★ At the command prompt:
★ Ntdsutil
★ Files
★ Info
This will display current information about the path and size of the Active Directory database and its log files.
Compact to D:DbBackup
You must specify a directory path and if the path name has spaces, the command will not work
unless you use quotation marks:
Quit (till you reach the command prompt)
A new compacted database named Ntds.dit can be found in D:DbBackup.
Copy the new ntds.dit file over the old ntds.dit file. You have successfully compacted the Active Directory database.

EDB.LOG: This is the transaction log file (10 MB). When EDB.LOG is full, it is renamed to EDBnnnn.log. Where
nnnn is the increasing number starting from 1.

EDB.CHK: This is the checkpoint file used to track the data not yet written to database file. This indicates the
starting point from which data is to be recovered from the log file, in case of failure.