We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now


NTDSA.DLL: Corrupt and Unreadable

Medium Priority
Last Modified: 2013-12-01

After applying Windows Updates this last Saturday to a Windows Server 2003 box (which is a domain controller, Exchange 2003 server, and backup server running Symantec Backup Exec 12.5), our backups have been failing.  After placing Backup Exec in debug mode, I determined that one file is corrupt or unreadable: C:\Windows\System32\dllcache\ntdsa.dll.  NTBackup can backup that file just fine.

I am able to perform operations on every other file within the dllcache folder, but I cannot rename, delete, or copy ntdsa.dll.

chkdsk does refer to ntdsa.dll:

The type of the file system is NTFS.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
386416 file records processed.
File verification completed.
216 large file records processed.
0 bad file records processed.
0 EA records processed.
4 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
46 percent complete. (814147 of 1425650 index entries processed)
Deleting index entry ntdsa.dll in index $I30 of file 4630.
1425650 index entries processed.
Index verification completed.

Errors found.  CHKDSK cannot continue in read-only mode.

Also, anytime that file is touched, there are several events logged in the system log of ID 55, with a source of NTFS that read as follows:

"The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume \Device\HarddiskVolume1."

When it is a backup job that attempts to backup that file (via the System State), the volume is listed as \Device\HarddiskVolumeShadowCopyX, where 'X' is a number that increments by one each time the backup runs.

Any ideas on how I can replace that file, ideally without rebuilding the entire server?  Do I need to run chkdsk with the /f switch?  This server is running on a hardware RAID-5 array, by the way.

Watch Question

Most Valuable Expert 2015
Unlock this solution with a free trial preview.
(No credit card required)
Get Preview


Thank you rindi.  We will try this tonight.  Unfortunately, this system only has one partition, which currently has 83GB of data.  The network administrator at the site in question is asking me how long the chkdsk /f operation will take, which of course is nearly impossible to estimate I believe.  I will let you know how it works out.
Most Valuable Expert 2015

83GB isn't that large, so I don't think this will take too long.
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a free trial preview!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.