Active Directory Directory foundations
Directory partitions and the database
Naming contexts, the global catalog, ESE, phantoms, and the difference between an object GUID and a local database tag.
Ask the server what it holds
RootDSE tells you about the directory server you’ve reached, including the naming contexts it holds. Start there instead of building distinguished names by hand.
Import-Module ActiveDirectory
$dc = 'dc1.contoso.com'
$root = Get-ADRootDSE -Server $dc
$root | Format-List dnsHostName,defaultNamingContext,configurationNamingContext,
schemaNamingContext,rootDomainNamingContext,namingContexts,
supportedLDAPVersion,supportedControl
RootDSE describes the LDAP service, outside the ordinary directory tree. In LDP, use an empty base DN, Base scope, and (objectClass=*). A subtree search against a domain DN is a different operation. Some discovery information is available before authentication; ordinary searches still depend on authentication and access checks. Request operational discovery properties explicitly when needed; wildcard attribute selection does not mean every server property. RootDSE’s definition lists the supported discovery attributes.
A forest contains several naming contexts
| Naming context | What it contains | Replication scope |
|---|---|---|
| Schema | Class and attribute definitions | Every DC in the forest |
| Configuration | Sites, services, partitions, forest configuration | Every DC in the forest |
| Domain | Users, groups, computers, OUs and domain configuration | DCs of that domain; partial replicas on GCs |
| Application | Application data, including AD integrated DNS partitions | The replicas enlisted for that partition |
DomainDnsZones and ForestDnsZones are application partitions. Check their replica sets when a DNS record appears on one DNS server but not another. You’ll need a separate replication check for each DNS application partition, even if the domain partition is healthy.
Discover where a partition should exist
The Configuration partition contains cross-reference objects under CN=Partitions. They describe directory naming contexts and their naming information. RootDSE’s namingContexts then tells you which naming contexts the selected server exposes.
$partitions = "CN=Partitions,$($root.configurationNamingContext)"
Get-ADObject -Server $dc -SearchBase $partitions -SearchScope OneLevel `
-LDAPFilter '(objectClass=crossRef)' -Properties nCName,dnsRoot,systemFlags |
Select-Object Name,nCName,dnsRoot,systemFlags
Compare the partition you expected with the server’s hosted replicas and the naming context named in the error. Was this DC meant to host the application partition? If it wasn’t enlisted, investigate placement. If it was enlisted but can’t receive the data, investigate replication. Application directory partitions have independently selected replica sets.
What a global catalog actually adds
A GC holds its own domain’s full directory replica and partial replicas of other domains in the forest. The partial attribute set, or PAS, controls the attributes included in those partial replicas. A forest search on port 3268 can find objects in other domains while omitting attributes that a query to their owning domain on port 389 would return. Use 3269 for GC over TLS.
Get-ADDomainController -Filter * -Server contoso.com |
Select-Object HostName,Domain,Site,IsGlobalCatalog,IsReadOnly
Get-ADObject -Server 'gc1.contoso.com:3268' -SearchBase '' `
-LDAPFilter '(sAMAccountName=alice)' -Properties mail
An empty search base with a GC is useful for searching its forest-wide view. It does not turn that partial view into a complete copy of every domain. Query a DC in the object’s domain when you need authoritative domain data. See the LDAP search notes.
A GC server stores a full replica of its own domain alongside partial replicas of other domains. Keep that storage distinction separate from the GC search interface: the protocol GC view is defined by the PAS. Read non-GC attributes through the owning domain’s LDAP interface, and record the actual port when comparing results. An RODC’s local domain replica is further subject to secret-caching and filtered-attribute rules; read-only does not mean identical to an ordinary writable replica.
LDAP and replication reach different interfaces
LDP uses LDAP. Repadmin uses directory replication interfaces over RPC. Both reach the directory service, but one can work while the other fails. For firewall and authentication problems, write down the tool, protocol, server and failed operation. “AD connectivity” is too broad to troubleshoot on its own.
Most AD module cmdlets add another hop: the client connects to ADWS on 9389 and ADWS accesses a local directory instance. A port in -Server can select a GC, LDS or mounted snapshot instance without changing the client’s transport into direct LDAP. Microsoft’s instance-selection reference is useful when two tools disagree about reachability.
ESE provides storage and transactions
AD stores data in an Extensible Storage Engine database, usually named ntds.dit. Transaction logs provide durability and recovery. Database pages can lag transactions already committed to the log; copying the DIT file alone is not a directory-aware backup.
The version store lets concurrent transactions see appropriate versions of data. Long transactions and expensive work can create pressure there. Its sizing and behavior depend on Windows release; see database diagnostics before treating a historical memory size as a tuning target.
The historical 8 KB page assumption also needs a date: Windows Server 2025 introduces a 32 KB capable format and a separately enabled forest-wide feature. An in-place upgrade does not automatically convert an existing database. Microsoft’s 32 KB database guidance describes the prerequisites and backup compatibility checks.
DNT, PDNT and objectGUID
DNT is a database’s local tag for an object. PDNT points to its parent in that database. They help explain how the directory reconstructs a hierarchy from stored records. They are not portable object identifiers and should not be compared across DCs.
objectGUID is the directory object’s stable identity across a rename or move within a forest. Recreating an OU with its former name does not recreate its identity. This distinction matters during object recovery.
A dynamic object’s expiration is a different lifecycle
An entry with the dynamicObject auxiliary class has a time to live. Its application must refresh that lifetime if it wants the entry retained. Expiration does not follow the ordinary deleted-object/tombstone recovery path: a dynamic object removed when its TTL expires leaves no tombstone. Microsoft’s dynamic-object description explains the lifecycle.
If an application’s object disappears, check its class, lifetime and refresh behavior before looking for a deletion or replication fault. Recycle Bin can’t recover an expired entry that never entered the normal deleted-object lifecycle. An expiring group-membership link is a separate mechanism again.
Phantoms represent references
A DC sometimes needs a local representation of a referenced object for which it has no full replica, such as a principal in another domain. A phantom supplies that internal reference. It is not a broken account that an administrator should delete from LDAP.
Phantom records carry the identity needed for the reference, such as DN, GUID and SID where applicable, and are not exposed as ordinary LDAP objects. A foreignSecurityPrincipal object under CN=ForeignSecurityPrincipals is a different, visible representation of an external security principal. Neither concept means that every unresolved group member should be deleted. Establish the referenced identity and owning directory before changing membership.
The infrastructure master historically maintains cross-domain references on DCs without a complete view. GC placement and Recycle Bin affect that work. The old “never put the infrastructure master on a GC” advice needs those conditions attached to it. Microsoft’s phantom and infrastructure master explanation covers the details.