Windows Server 2019 — NTDS service pages heavily and stalls AD replication — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

The Active Directory Domain Services on Windows Server 2019 pages heavily, causing slow LDAP responses and stalled replication. Logons slow across the domain, Group Policy processing times stretch, and SYSVOL convergence falls behind on partner DCs.

Environment & Reproduction

Reproduce on DCs with low memory or oversized indexes. Inspect Directory Service log and counters for NTDS and database cache.

Get-Service -Name ntds
Get-WinEvent -LogName System -MaxEvents 40
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

Root Cause Analysis

Causes include insufficient RAM for the NTDS cache, runaway LDAP queries, oversized indexes after schema changes, or competing workloads on the DC.

Quick Triage

Capture NTDS database cache size, active LDAP query patterns, and replication backlog before changes.

sc.exe query ntds
Get-Service -Name ntds | Select-Object Status,StartType
Get-EventLog -LogName System -Newest 30 | Where-Object {$_.Source -match 'ntds'}

Step-by-Step Diagnosis

Sample NTDS counters, list expensive LDAP queries, and check replication backlog metrics.

Get-WinEvent -LogName System -MaxEvents 50 | Where-Object {$_.ProviderName -match 'ntds'} | Select TimeCreated,Id,LevelDisplayName,Message
sc.exe qfailure ntds
sfc /verifyonly

Solution — Primary Fix

Add memory or reduce competing roles on the DC, then restart NTDS to rebuild the cache cleanly.

Restart-Service -Name ntds -Force
Get-Service -Name ntds | Select-Object Status,StartType
Get-WinEvent -LogName System -MaxEvents 20 | Where-Object {$_.ProviderName -match 'ntds'}

Solution — Alternative Approaches

If a runaway query is at fault, identify and throttle the calling application and add an appropriate index.

sc.exe config ntds start= auto
sc.exe failure ntds reset= 86400 actions= restart/60000/restart/60000/run/1000
Restart-Service -Name ntds -Force

Verification & Acceptance Criteria

Logon and LDAP query latency return to baseline and replication backlog clears within agreed SLA.

Get-Service -Name ntds
Get-WinEvent -LogName System -MaxEvents 25 | Where-Object {$_.ProviderName -match 'ntds' -and $_.LevelDisplayName -eq 'Error'}
Test-NetConnection -ComputerName localhost -Port 

Rollback Plan

Restore the previous DC role layout if added roles caused contention or remove problematic indexes.

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5
wbadmin get versions
# Restore previous configuration export if available

Prevention & Hardening

Keep DCs role-focused, monitor LDAP query latency, and right-size memory for the directory dataset.

Get-Service -Name ntds | Export-Clixml C:/Temp/ntds-baseline.xml
Get-WinEvent -LogName System -MaxEvents 50 > C:/Temp/ntds-events.txt
Get-ScheduledTask | Where-Object {$_.TaskName -match 'ntds'}

Related Errors & Cross-Refs

Related to events 1644, 2089, and NTDS database cache warnings.

Related tutorial: View the step-by-step tutorial for Windows Server 2019.

View all Windows Server 2019 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn references for AD DS performance tuning on Windows Server 2019.