On a periodic basis, such as a couple of times a year, you should
check the health of the DIT file
ntds.dit) on your domain controllers. Using the
utility, you can check the integrity
and semantics of the Active Directory database and reclaim
whitespace, which can dramatically reduce the size of the DIT. Also,
just as you should rotate the password for the Administrator accounts
in the forest, you should also change the DS Restore Mode
Administrator password as well. You may even need to do this more
frequently depending on whether you have people leave your team that
should no longer know the password.
Unfortunately, to accomplish all these tasks—except changing
the DS Restore Mode Administrator password—you have to boot the
domain controller into DS Restore Mode. That means you will have to
have schedule downtime for the machine. Also, to use DS Restore Mode,
you need console access either through being physically at the
machine or with out-of-band access, such as with
Compaq’s Remote Insight
Lights Out Board (RILOE). There is one other option using Terminal
Services. You can modify the
boot.ini file on
the domain controller to automatically start up in DS Restore Mode.
You can then use a Terminal Services connection to log in to the
machine. For more information, check out MS Knowledge Base article
256588 from http://support.microsoft.com.
There are several checks you can perform against the DIT file to determine whether ...