A domain controller named DC12 runs critical services. Restructuring of the organizational
unit hierarchy for the domain has been completed and unnecessary objects have been
deleted.
You need to perform an offline defragmentation of the Active Directory database on DC12.
You also need to ensure that the critical services remain online.
What should you do?

A.
Start the domain controller in the Directory Services restore mode. Run the Defrag utility.

B.
Start the domain controller in the Directory Services restore mode. Run the Ntdsutil utility.

C.
Stop the Domain Controller service in the Services (local) Microsoft Management Console
(MMC). Run the Defrag utility.

D.
Stop the Domain Controller service in the Services (local) Microsoft Management Console
(MMC). Run the Ntdsutil utility.

Explanation:
http://support.microsoft.com/kb/232122
Performing offline defragmentation of the Active Directory database
Active Directory automatically performs online defragmentation of the database at certain
intervals (by default, every 12 hours) as part of the Garbage Collection process. Online
defragmentation does not reduce the size of the database file (Ntds.dit), but instead
optimizes data storage in the database and reclaims space in the directory for new objects.
Performing an offline defragmentation creates a new, compacted version of the database
file. Depending on how fragmented the original database file was, the new file may be
considerably smaller.
http://rickardnobel.se/when-to-offline-defrag-ntds-dit/
When to offline defrag the Active Directory database
This article will show a simple way to determine if there is any gain to do an offline defrag of
your Active Directory database.
During normal operations the Active Directory service will do an online defragmentation of
the Active Directory database (always called ntds.dit) each 12 hours. This online defrag will
arrange all pages in an optimal way internal in the ntds.dit, however the file size will never
shrink, sometimes even grow. During the years of operations of the ntds.dit the file size will
increase as user accounts, organizational units, groups, computers, dns records and more
are added and later removed. When deleted objects are finally removed (after the so called
tombstone lifetime, typically 180 days) the space they have occupied will unfortunately not
decrease.

The actual size of the ntds.dit could be easily studied through Explorer, as above. The size
of the database is in this example around 575 MB. Note that Active Directory does not use a
file level replication, so the file could be of various size on each Domain Controller in your
domain. If wanted there is the possibility to take the AD services offline on one DC and then
do an offline defragmentation of ntds.dit. This would both arrange all pages the best possible
way, and also to reclaim any empty space inside the database, which could make backup
and restore faster and also possible increase AD performance.
The offline defrag means “offline” from an Active Directory perspective. This means that on
Windows 2000 and 2003 you will have to reboot into Directory Services Restore Mode, and
on Windows 2008 and R2 you will have to stop the AD services by typing “net stop ntds” in
the command prompt. So in Windows 2008 and later it is far easier, but still something that
you do not want to do if not necessary.
There are numerous article on the web how to do the actual offline defrag, so we will not
cover that part here. However, we will see the perhaps most important information and that
is to be able to see in advance the amount of space that we could reclaim. With this
information we could make our decision based on fact and not guesses. This has been
possible since at least Windows 2003, but is not well documented.

To enable this you will have to alter a registry value on the Domain Controller you will
investigate the reclaimable MBs. Use regedit and find the following key:
HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Services \ NTDS \ Diagnostics
Change the value “6 Garbage Collection” from 0 to 1. This will increase the logging from the
Garbage Collection process which runs together with the online defrag. So now wait for the
next online defragmentation which runs twice a day and then study the Directory Service log
in Event Viewer.

Search for event id 1646, usually together with event ids 700 and 701.

Here we can note the amount of space that would be reclaimed from an offline defrag. The
top value is the number of MB that the offline defrag would recover, here almost half the
database size. If the amount is negligible then do not worry about this any more, and if there
is a considerable amount of MBs reported then you could plan to do the offline defrag.

Note that both the change of registry key and the actual offline defrag has to be done on
each domain controller, since neither does replicate.
As noted above we will not look at the commands for the offline defragmentation here, since
they are well documented already.