You are currently offline, waiting for your internet to reconnect

How to Use the Online Dbdump Feature in Ldp.exe

Support for Windows Server 2003 ended on July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

This article was previously published under Q315098
You can use the online dbdump feature in Ldp.exe to view the values that are stored in the database while a domain controller is running. You trigger the online dbdump feature by modifying the dumpDatabase attribute on the rootDSA.

The values that you specify for this attribute are the attributes other than the default attributes that you want to dump. Note that the values that you specify are the name for this attribute. The dumpDatabase feature first checks that you have enough rights for dumping the database. It then dumps the database into the Ntds.dmp file. The Ntds.dmp file is located in the same folder as the database file (.dit). The default attributes are:
  • DNT
  • PDNT
  • OBJ
  • RDNTyp
  • CNT
  • DelTime
  • ABVis

Usage Example: Investigate an SPN Issue with Conflicting CNF or Deleted DEL Attributes

Create the Ntds.dmp file:
  1. Start Ldp.exe on the domain controller that is logging the NTDS event 1645.
  2. Connect locally, and then bind as an Enterprise administrator.
  3. Click Modify on the Browse menu.
  4. Edit for Attribute: dumpdatabase.
  5. Edit for Values: name ncname objectclass objectguid instancetype. You must leave one space between the attributes.
  6. Click Enter. The Entry List box contains the following entry:
    [Add]dumpdatabase: name ncname objectclass objectguid instancetype
  7. Click the Extended and Run options.
  8. The %systemroot%\NTDS\Ntds.dmp file is created, or you receive an error message in Ldp.exe that you must investigate.
The Ntds.dmp file is a text file. Look for the conflicting or deleted GUID that was reported in event 1645 to see the internal reference mismatch.

Sample Dump File

The following sample shows that the CROSSREF object for domain PDT is pointing to a wrong object that has already been deleted:
3953   2326   true  3      1      0      -                 1163   -     43947   196619 56.6E.52.8A.2E.B4.00.43.BE.B1.B3.57.91.AD.F5.BE PDT...3947   1161   false 1376281 2      0      2001-08-04 11:02.47 -      --     -      -      9E.4C.AB. pdtDEL:36ab4c9e-6581-4f2b-a031-59d5c27468f2...3958   1161   false 1376281 3      0      2001-08-04 23:02.47 -      --     -      -      85.0B.3B.A1.EC. pdt				
The internal reference points to 3947, although it should point to the new 3958 object for dc=pdt,dc=net.

You may resolve this issue with the semantic checker of the latest version of the Ntdsutil.exe tool.

Article ID: 315098 - Last Review: 09/11/2011 09:28:00 - Revision: 5.0

Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server, Microsoft Windows Server 2003 Service Pack 1, Microsoft Windows Server 2003 Service Pack 2, Windows Server 2008 Standard, Windows Server 2008 Enterprise, Windows Server 2008 R2 Standard, Windows Server 2008 R2 Enterprise

  • kbhowto KB315098