NTDSA.DLL: Corrupt and Unreadable

Posted on 2011-04-28
Last Modified: 2013-12-01

After applying Windows Updates this last Saturday to a Windows Server 2003 box (which is a domain controller, Exchange 2003 server, and backup server running Symantec Backup Exec 12.5), our backups have been failing.  After placing Backup Exec in debug mode, I determined that one file is corrupt or unreadable: C:\Windows\System32\dllcache\ntdsa.dll.  NTBackup can backup that file just fine.

I am able to perform operations on every other file within the dllcache folder, but I cannot rename, delete, or copy ntdsa.dll.

chkdsk does refer to ntdsa.dll:

The type of the file system is NTFS.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
386416 file records processed.
File verification completed.
216 large file records processed.
0 bad file records processed.
0 EA records processed.
4 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
46 percent complete. (814147 of 1425650 index entries processed)
Deleting index entry ntdsa.dll in index $I30 of file 4630.
1425650 index entries processed.
Index verification completed.

Errors found.  CHKDSK cannot continue in read-only mode.

Also, anytime that file is touched, there are several events logged in the system log of ID 55, with a source of NTFS that read as follows:

"The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume1."

When it is a backup job that attempts to backup that file (via the System State), the volume is listed as \Device\HarddiskVolumeShadowCopyX, where 'X' is a number that increments by one each time the backup runs.

Any ideas on how I can replace that file, ideally without rebuilding the entire server?  Do I need to run chkdsk with the /f switch?  This server is running on a hardware RAID-5 array, by the way.

Question by:FCTGIS
    LVL 87

    Accepted Solution

    Yes, run chkdsk with the /f switch. Make sure you do that during off-hours as the server will need to reboot and depending on the size of the partition the operation can take very long (as this is the system partition which normally has a limited size it shouldn't take too long though).

    Author Comment

    Thank you rindi.  We will try this tonight.  Unfortunately, this system only has one partition, which currently has 83GB of data.  The network administrator at the site in question is asking me how long the chkdsk /f operation will take, which of course is nearly impossible to estimate I believe.  I will let you know how it works out.
    LVL 87

    Expert Comment

    83GB isn't that large, so I don't think this will take too long.

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    Join & Write a Comment

    A quick step-by-step overview of installing and configuring Carbonite Server Backup.
    Workplace bullying has increased with the use of email and social media. Retain evidence of this with email archiving to protect your employees.
    This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
    To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

    731 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now