Managing Active Directory Performance

An Overview on Performance Monitoring and Management

Performance monitoring is the process of accurately and consistently measuring performance, so that you can identify any potential bottlenecks which may be impairing the way in which Active Directory performs within your environment. A bottleneck can take place on any Windows subsystem or network component, and occurs when one resource prevents a different resource from operating optimally. Incorrectly configured settings or the insufficient distribution of resources between network components can result in bottlenecks occurring.

Monitoring performance can be considered the initial step in defining any performance optimization strategy for your network or network resources. Before you can optimize performance, you have to identify and eliminate existing bottlenecks, or potential bottlenecks. There are a few system and network monitoring tools provided by Windows Server 2003, which can be used to monitor Active Directory performance.


The steps involved in a typical performance monitoring process are listed below. Because performance monitoring and optimization is a continuous process, you should regularly monitor performance, especially when business needs and requirements change.

  1. Define a baseline of current performance
  2. Identify existing and potential bottlenecks
  3. Plan for, and effect any changes necessary to deal with all identified bottlenecks.
  4. Measure the impact or success of any implemented changes.

A few factors that should be considered when monitoring and managing performance are detailed in the following section.

When it comes to monitoring and managing Active Directory performance, the tasks which you typically need to perform are summarized below:

Defragmenting the Active Directory Database

With Windows Server 2003 Active Directory, a garbage collection process starts each 12 hours (default) on domain controllers. The garbage collection process is a maintenance cycle that basically purges expired objects from the Active Directory database, and deletes unnecessary log files. Another function within the garbage collection process is the performance of online defragmentation of the Active Directory database, and the re-indexing of its data to enable faster access. These two functions are the last functions performed by the garbage collection process, and generally increase the performance of the Active Directory database. The online defragmentation process of the Active Directory database does not reduce the size of the database file, nor does it recover available free space from the Active Directory database.

The defragmentation of the Active Directory database is necessary because as data is deleted from the database, gaps which ultimately reduce read or write performance, exist in the data as it is located on the physical disk. Defragmenting the Active Directory database assists in keeping the database functioning at its optimal performance level for read and write operations. A read operation and write operation can be spilt into two components, namely; the data seeking component, and the data reading or writing component. With reference to a typical write operation, seeking relates to finding the next free space that you can write data to, and data writing refers to the commitment of data on the disk. When gaps exist in the data as it is located on the physical disk, seek time is increased. This in turn leads to poorer performance of the Active Directory database.


As mentioned earlier, the online defragmentation process of the Active Directory database does not reduce the size of the database file, nor does it recover available free space. You can however perform an offline defragmentation of the Active Directory database if you need to recover available free space from the database.

A number of Active Directory management and maintenance tasks can be performed using the Ntdsutil utility. These include:

To perform an offline defragmentation of the Active Directory database, you have to boot in the Directory Services Restore Mode so that the Active Directory database remains offline. In Directory Services Restore Mode, a domain controller boots without a copy of the Active Directory database. You can switch to Directory Services Restore Mode by rebooting the computer, and then pressing F8 when prompted during startup.

How to change the garbage collection interval (how often online defragmentation of the Active Directory database occurs)

You must use of the following utilities/tools to change the garbage collection interval:

To change the garbage collection interval, using ADSI Edit, follow the steps below.

  1. Place the Windows Server 2003 CD-ROM in the CD-ROM drive.
  2. Start the Windows Support Tools Setup Wizard.
  3. On the End User License Agreement screen, click I Agree. Click Next.
  4. Insert your name, and the name of the organization. Click Next.
  5. Set the location for the installation of the support tools.
  6. Click Install Now. After the installation, click Finish.
  7. Click Start, Run, and enter mmc in the Run dialog box. Click OK.
  8. From the File menu, click Add/Remove Snap-in.
  9. When the Add/Remove Snap-in dialog box opens, click Add.
  10. When the Add Standalone Snap-in dialog box opens, select ADSI Edit, and then click Add.
  11. Click Close. Click OK to exit the Add/Remove Snap-in dialog box.
  12. Proceed to right-click ADSI Edit, and select Connect To from the shortcut menu.
  13. When the ADSI Edit Connection Settings dialog box opens, in the Select a well known Naming Context list box, choose Configuration. Click OK.
  14. In the left pane, expand the CN=Configuration,DC=(Domain name),DC=(Domain Name) node, expand CN=Services node, and then expand the CN=Windows NT node.
  15. Right-click CN=Directory Service, and choose Properties from the shortcut menu.
  16. When the CN=Directory Service dialog box opens, select the garbageCollPeriod option from the Attributes: list box.
  17. A Value column setting specified as <Not Set> means that the default collection interval of 12 hours is enabled. This means that because the garbage collection process runs each 12 hours, the online defragmentation of the Active Directory database occurs too at 12 hour intervals. The online defragmentation of Active Directory database is the last operation performed by the garbage collection process.
  18. To change this setting, click Edit.
  19. When the Integer Attribute Editor dialog box opens, set a new value (in hours) for the new garbage collection interval.
  20. Click OK.
  21. Verify that the Value column setting shows the new value which you configured.
  22. Click OK.

How to perform an offline defragmentation of the Active Directory database

It is recommended that you perform an offline defragmentation of the Active Directory database when you are bound to recover a considerable quantity of free space. Before performing the offline defragmentation process, you should roughly determine the quantity of free space that would result from defragmenting the database. You can do this by configuring the Directory Service to create an event log entry that estimates this figure for you.


To configure the Directory Service to create an event log that estimates what free space would be available after an offline defragmentation of the Active Directory database is performed,

  1. Click Start, Run, and enter regedt32.exe in the Run dialog box. Click OK.
  2. The Registry Editor opens.
  3. Locate the 6 Garbage Collection entry by expanding HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Services, NTDS, and then Diagnostics.
  4. Proceed to double-click 6 Garbage Collection entry.
  5. Enter 1 in the Value Data text box.
  6. Click OK.

Before you perform an offline defragmentation of the Active Directory database, you should first back up system state data. System state data typically consists of boot and system files needed to start the operating system, the COM+ Class Registration database, and the Registry.

To perform an offline defragmentation of the Active Directory database,

  1. Reboot the computer.
  2. When prompted, during startup, press F8.
  3. In the Windows Advanced Options menu, choose the following option: Directory Services Restore Mode (Windows DCs only). Press Enter.
  4. Choose the operating system to start, and press Enter.
  5. When the Safe Mode logon prompt appears, enter the appropriate local administrator account password. Click OK.
  6. When a message appears, stating that Windows is running in Safe Mode, click OK.
  7. Proceed to open a command prompt window.
  8. To access the Ntdsutil utility, enter ntdsutil.
  9. Enter files
  10. To create a defragmented copy of the Active Directory database, enter compact to <drive>:\<directory>.
  11. Enter quit.
  12. Enter quit to close the Ntdsutil utility.
  13. In Windows Explorer, proceed to copy the new ntds.dit file to the proper location.
  14. In the Active Directory log files folder, delete any files containing a .LOG extension.
  15. Reboot the server.

Moving the Active Directory Database and Log Files

The Ntdsutil utility is used to move the Active Directory database and log files to different hard drives and controllers. You should first back up system state data before using Ntdsutil utility to move the Active Directory database and log files.

To move the Active Directory database and log files,

  1. Reboot the computer.
  2. When prompted, during startup, press F8.
  3. In the Windows Advanced Options menu, choose the following option: Directory Services Restore Mode (Windows DCs only). Press Enter.
  4. Choose the operating system to start, and press Enter.
  5. When the Safe Mode logon prompt appears, enter the appropriate local administrator account password. Click OK.
  6. When a message appears, stating that Windows is running in Safe Mode, click OK.
  7. Proceed to open a command prompt window.
  8. To access the Ntdsutil utility, enter ntdsutil.
  9. Enter files
  10. To move the Active Directory database to a new location, enter move DB to <drive>:\<directory>.
  11. To move the Active Directory log files to a new location, enter move logs to <drive>:\<directory>.
  12. Enter info to verify that the Active Directory database and log files are being referenced in the correct location.
  13. Enter quit.
  14. Enter quit to close the Ntdsutil utility.

Monitoring Active Directory Performance with Events Logs and System Monitor

When monitoring Active Directory performance, it is important to bear in mind that performance issues relating to Active Directory can indeed be caused by other network infrastructure components. Therefore, when you design you strategy for monitoring Active Directory performance, you need to monitor all the other network components which essentially support the directory service. As is the case with all computers or machines in a network environment, domain controllers too have basic resource requirements.

When defining your strategy for monitoring domain controller performance within your Active Directory environment, you should typically include the following:

You can use the Windows Server 2003 Event Viewer tool to monitor security events, system events, application events, and events for particular services, such as directory service events. What this means is that you can use Event Viewer to monitor Active Directory. To access Event Viewer to view the event logs on a domain controller, click Start, Programs, Administrative Tools, and then click Event Viewer. The following three logs are the default logs which can be viewed in Event Viewer:

For all event log types, other than the Security log, three different levels of events are displayed:

When Active Directory is installed, the following two additional logs are enabled:

The event logs which are of importance for monitoring the directory service are listed below:

Windows Server 2003 includes the Performance console which can be used to monitor Active Directory. You can monitor the server on which Windows Server 2003 is installed, as well as remote servers. To open the Performance console, click Start, Programs, Administrative Tools, and then click Performance. Performance counters is the terminology used when referring to the metrics which are monitored via the Performance console. The counters are grouped in relation to the performance objects which they represent. An object is associated with a resource or service which can be monitored. What this means is that for an object, you can use the counters associated with that particular object to monitor performance.
The Performance console contains the following components.

As just mentioned, System Monitor is included in the Performance console utility. When System Monitor is selected in the left pane of the Performance console utility, the right pane shows a large graph which illustrates the three recommended general system counters. These are Memory:Pages/sec, PhysicalDisk:Avg disk queue length, and Processor:%Processor time. You can use the bottom section of the graph pane to select different counters.
Through System Monitor, you can perform the following tasks:

To monitor the performance of Active Directory, you have to first choose the performance object and the related performance counters which you want to monitor. The specific object which should be monitored to track Active Directory operation and performance is the NT Directory Services (NTDS) object. The counters which represent different functions, components or aspects of Active Directory are represented by the counters of the NTDS object, including:

While the NTDS object is the primary object for monitoring Active Directory, you should also monitor other objects that support Active Directory. The more important counters of the NTDS object that should be used to monitor Active Directory are listed below:

The important counters of the FileReplicaSet object that should be monitored as part of your Active Directory monitoring strategy are listed below:

Other important System, Processor, and Memory object counters that should be monitored when monitoring Active Directory are listed below.

How to monitor Active Directory performance with System Monitor

  1. Click Start, Administrative Tools, and then click Performance.
  2. In the left pane, click the System Monitor node.
  3. In the right pane, right-click on the System Monitor graph and then select Add Counters from the shortcut menu.
  4. When the Add Counters dialog box opens, click Use Local Computer Counters if you want to monitor the computer on which System Monitor is installed, or click Select Counters From Computer if you want to monitor another computer.
  5. In the Performance Object drop down box, select NTDS.
  6. If you want to monitor all counters of the NTDS object, click All Counters.
  7. If you only want to monitor certain counters, click Select Counters From List, and then choose the counters which you want to monitor by selecting the counter and clicking Add.
  8. Click Close.
  9. The counters which you have just enabled should be displayed under the graph in the right pane of System Monitor.

Monitoring Active Directory Performance with Performance Logs and Alerts

You can use the functionality of the Performance Logs and Alerts to create counter logs, trace logs, and system alerts automatically from the local computer or a remote computer.

How to create a counter log

  1. Click Start, Administrative Tools, and then click Performance.
  2. When the Performance console opens, double-click Performance Logs And Alerts, and then click Counter Logs.
  3. Right-click in a blank portion of the details pane, and then select New Log Settings from the shortcut menu.
  4. When the New Log Settings dialog box opens, enter a name for the new counter log in the Name box. Click OK.
  5. On the General tab, verify that the information in the Current Log File Name box is the correct information for the filename and path of the log file.
  6. Click the Add Counters button.
  7. When the Add Counters dialog box appears, select the Use Local Computer Counters option, or click the Select Counters From Computer option and specify the UNC name of the computer that you want to monitor.
  8. In the Performance Object drop down box, select NTDS.
  9. If you want to monitor all counters of the NTDS object, click All Counters.
  10. If you only want to monitor certain counters, click Select Counters From List, and then choose the counters which you want to monitor by selecting the counter and clicking Add.
  11. Click Close.
  12. On the General tab, in the Sample Data Every section of the tab, set the appropriate values in the Interval and Units boxes.
  13. Click the Log Files tab, and choose either Text File (Comma Delimited), Text File (Tab Delimited), Binary File, Binary Circular File or SQL Database.
  14. Click Configure
  15. When the Configure Log Files dialog box opens, in the Locations box, enter the location of the folder in which the log file should be created.
  16. In the Log File Size area, choose either the Maximum Limit option; or the Limit Of option and set the size to which data should be collected. Click OK.
  17. In the Log Files tab, click End File Names With, and then select the log file suffix.
  18. You can enter a description for the log file in the Comment box.
  19. If you want to overwrite an existing log file with this particular log file, click Overwrite Existing Log File.
  20. Click the Schedule tab, and set the appropriate schedule options for the counter log.
  21. Click OK.

How to create a trace log

  1. Click Start, Administrative Tools, and then click Performance.
  2. When the Performance console opens, double-click Performance Logs And Alerts, and then click Trace Logs.
  3. Right-click in a blank portion of the details pane, and then select New Log Settings from the shortcut menu.
  4. When the New Log Settings dialog box opens, enter a name for the new trace log in the Name box. Click OK.
  5. Select one of the following options:
    • Events Logged By System Provider and then proceed to specify events that should be logged;
    • Nonsystem Providers and the click Add to choose the appropriate nonsystem providers.
  6. Click the Log Files tab, and set the necessary settings for the log file.
  7. Click the Schedule tab, and set the appropriate schedule options for the trace log
  8. Click OK.

How to create an alert

  1. Click Start, Administrative Tools, and then click Performance.
  2. When the Performance console opens, double-click Performance Logs And Alerts, and then click Alerts.
  3. Right-click in a blank portion of the details pane, and then select New Alert Settings from the shortcut menu.
  4. When the New Alert Settings dialog box opens, enter a name for the new alert in the Name box. Click OK.
  5. Enter a comment for the alert in the Comment box on the General tab.
  6. Click Add.
  7. In Add Counters dialog box, specify the computer for which you want to create this alert.
  8. In the Performance Object list, choose NTDS.
  9. Choose the particular counters which you want to monitor, and then click Add. Click Close
  10. On the General tab, in the Alert When The Value Is box, set either Under or Over.
  11. In the Limit box, enter the value which should trigger the alert.
  12. In the Sample Data Every section of the tab, set the appropriate values in the Interval and Units boxes.
  13. Click the Action tab, and select between the following options:
    • Log An Entry In The Application Event Log
    • Send A Network Message To
    • Start Performance Data Log
    • Run This Program
    • Command Line Arguments
    Click OK.
  14. Click the Schedule tab, and set the appropriate schedule options.
  15. Click OK.

Best Practices for Monitoring Active Directory Performance

A few best practices for monitoring Active Directory performance using Event Logs, System Monitor, and Performance Logs and Alerts are outlined in below.



Top 5 Free Networking Tools

Bookmark Managing Active Directory Performance

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.