How to recover from Event ID 1168 and Event ID 1003 error messages

When you boot an Active Directory domain controller into normal mode following the restoration of its Active Directory database, the following error message is displayed:When a domain controller that is affected by the scenario described in this article is booted into Directory Services Restore Mode (DSRM), the Directory Services event log contains the following events:

Event ID: 1168
Source: NTDS General
Category: Internal Processing
Description: Error -1811(fffff8ed) has occurred (Internal ID 404ab). Please contact Microsoft Product Support Services for assistance.

Event ID: 1003
Source: NTDS General
Category: Internal Processing
Description: The Windows Directory Services database cannot be initialized and returned error -1811. Unrecoverable error, the directory can't continue.

The "-1811" strings in Events 1168 and 1003 map to the symbolic Jet error "JET_errFileNotFound." This indicates that the Active Directory database file, Ntds.dit, does not exist in the folder referred to by the DSA Database File setting in the registry.

Note The DSA Database File setting in the HKEY_LOCAL_MACHINE\SYSTEM\CCS\Services\NTDS\Parameters section of the Windows registry points to the drive and directory from which a domain controller loads its Ntds.dit database.

To resolve this issue, you must investigate what operations took place prior to this error condition being reported. To do this, follow these steps:

1. Verify that the drive and path that are configured to host the Active Directory database exist. To do this, boot into Directory Services Restore Mode (DSRM) and type Ntdsutil files info at a command prompt.
   1. If the physical drive that hosts Ntds.dit has been removed from the local machine, do one of the following things:
      • Reinstall the drive, assign the appropriate drive letters, and then restore the system state.
      • Change the database path to an existing volume by using the
        NTDSUTIL FILES SET PATH DATABASE location
        command to define a new database path. Restore the Active Directory database to that drive and path by using an Active Directory-aware database utility. Also, change the path for the Active Directory database log files.
        
        For additional information on using Ntdsutil, click the following article numbers to view the articles in the Microsoft Knowledge Base:
        315131  (http://support.microsoft.com/kb/315131/ ) HOW TO: Use Ntdsutil to Manage Active Directory Files from the Command Line in Windows 2000
        816120  (http://support.microsoft.com/kb/816120/ ) How To Use Ntdsutil to Manage Active Directory Files from the Command Line in Windows Server 2003
   2. The logical drive letters assigned to drives and partitions on the computer may be reordered due to SCSI termination changes, updated SCSI drivers, or administrators assigning new logical drive letters to logical or physical drives.
   3. If the logical drive letter assigned to Ntds.dit has been reordered and is assigned a different logical drive letter than the path displayed by NTDSUTIL FILES INFO, do one of the following things:
      • Reassign the original drive letter to the volume that hosts the Ntds.dit file.
      • Change the database path to an existing NTDS volume, and use the
        NTDSUTIL FILES SET PATH DATABASE location
        command to assign the matching database path. Also, change the path for the Active Directory database log files. Finally, restore the Active Directory database to that drive and path.
2. If an administrator attempted to restore system state by using an Active Directory-aware backup/restore utility that failed to place the Active Directory database or log files in the correct drive and path, contact the vendor of that utility.
3. If jet database operations such as offline defrags, integrity checks, or semantic database analysis were performed against an Active Directory database that was moved to another drive and path, ensure that the processed Ntds.dit file resides in the drive and path indicated by the DSA Database File setting in the registry. You can also discover the current database path by booting into Directory Services Restore Mode (DSRM) and typing the NTDSUTIL command NTDSUTIL FILES INFO. For example, type Ntdsutil files info.

Any manual or automated attempt to restore the system state by using a non-Active Directory-aware backup/restore utility or by copying an Active Directory database to a domain controller's local volume is not supported and may result in forest corruption. Such improperly restored domain controllers should be restored by using a system state backup, or they should be reinstalled and promoted back into the domain prior to booting into online Active Directory mode.

This behavior is expected.

When you repair the Active Directory database with the Esentutl.exe utility, you must ensure that only the database log files are moved or deleted after the repair is complete. The Ntds.dit file must not be deleted or moved. This file must remain in the same location where it had been installed. By default, this location is the C:\Winnt\Ntds folder.

Technical support for Windows x64 editions

Your hardware manufacturer provides technical support and assistance for Microsoft Windows x64 editions. Your hardware manufacturer provides support because a Windows x64 edition was included with your hardware. Your hardware manufacturer might have customized the Windows x64 edition installation with unique components. Unique components might include specific device drivers or might include optional settings to maximize the performance of the hardware. Microsoft will provide reasonable-effort assistance if you need technical help with your Windows x64 edition. However, you might have to contact your manufacturer directly. Your manufacturer is best qualified to support the software that your manufacturer installed on the hardware.

For product information about Microsoft Windows XP Professional x64 Edition, visit the following Microsoft Web site: For product information about Microsoft Windows Server 2003 x64 editions, visit the following Microsoft Web site: