Windows Server 2025 Active Directory 32k Database Page Size Initialization

1. Scope, Background & Architectural Objective

For over two decades (since Windows 2000), Active Directory Domain Services has utilized the Extensible Storage Engine (ESE / JET blue) formatted with a fixed 8k (8,192-byte) database page size.

Under legacy 8k architecture, records exceeding page boundaries require costly long-value overflow pages. This creates severe performance degradation in enterprise directories with dense multi-valued attributes, deep group nestings, and large security identifier (SID) histories.

Windows Server 2025 introduces the native 32k (32,768-byte) database page size:

• Quadruples page capacity, allowing large multi-valued attributes and complex objects to reside on single database pages.
• Drastically reduces database fragmentation and IOPS overhead during directory searches and Kerberos ticket evaluation.
• Accelerates replication speed and index tree traversals.

Forest Immutability Rule

Once the 32k Database Page Size Feature is activated across a forest, the change is permanent. Legacy Domain Controllers (Windows Server 2022, 2019, 2016) can NEVER be promoted into the forest again. All Domain Controllers must be running Windows Server 2025.

---

2. Prerequisites & Pre-Flight Verification

Step 1: Verify Windows Server 2025 Environment

Run on the target Domain Controller to confirm operating system build:

# Confirm Windows Server 2025 build (Build 26100+)
[Environment]::OSVersion.Version
(Get-CimInstance Win32_OperatingSystem).Caption

Step 2: Storage Alignment Check (4Kn / 512e)

Ensure the underlying storage volume hosting C:\Windows\NTDS uses modern 4K native or aligned sector sizes:

Get-Volume -DriveLetter C | Get-Disk | Select-Object Number, FriendlyName, SectorSize, LogicalSectorSize

Step 3: Domain Controller Exclusivity Check (Migration Mode Only)

If upgrading an existing domain rather than a greenfield forest, verify that every single DC in the entire forest is running Windows Server 2025:

Get-ADDomainController -Filter * | Select-Object Name, OperatingSystem, OperatingSystemVersion

(If any DC reports Windows Server 2022 or older, halt immediately. Decommission legacy DCs before proceeding).

---

3. Execution Path A: Greenfield Forest Deployment (Native 32k)

When building a brand new forest root using Windows Server 2025, enable the 32k database format during initial forest installation.

Step 1: Pre-Configure 32k Registry Flag

Before executing Install-ADDSForest, instruct the AD DS promotion wizard to create the database with 32k pages:

# Set registry override for 32k ESE page size allocation
New-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Name "Database 32k Pages Enabled" -Value 1 -Type DWord

Step 2: Promote Forest Root DC

$DSRM_Password = Read-Host -Prompt "Enter secure DSRM Password" -AsSecureString

Install-ADDSForest `
    -DomainName "corp.internal" `
    -DomainNetbiosName "CORP" `
    -ForestMode "WinThreshold" `
    -DomainMode "WinThreshold" `
    -InstallDns:$true `
    -DatabasePath "C:\Windows\NTDS" `
    -LogPath "C:\Windows\NTDS" `
    -SysvolPath "C:\Windows\SYSVOL" `
    -SafeModeAdministratorPassword $DSRM_Password `
    -NoRebootOnCompletion:$false `
    -Force:$true

---

4. Execution Path B: Existing Windows Server 2025 Forest Activation

If the forest was promoted with legacy 8k pages and all DCs are now running Windows Server 2025, enable the feature at the forest level.

Step 1: Enable the AD Optional Feature

Run on the Schema Master DC:

# Verify feature is available
Get-ADOptionalFeature -Filter "Name -like '*32k*'"

# Enable forest-wide 32k page feature
Enable-ADOptionalFeature `
    -Identity "Database 32k pages feature" `
    -Scope ForestOrConfigurationSet `
    -Target "corp.internal" `
    -Confirm:$false

Step 2: Trigger Database Conversion on Each Domain Controller

Once the optional feature replicates, each Domain Controller converts its local ntds.dit database during the next maintenance cycle or offline defragmentation:

# 1. Stop Active Directory Domain Services gracefully
Stop-Service ntds -Force

# 2. Convert database to 32k page structure using ntdsutil
# (Alternative: Create clean IFM or seize database conversion)
esentutl.exe /d "C:\Windows\NTDS\ntds.dit" /p32

# 3. Start Active Directory Domain Services
Start-Service ntds

---

5. Operational Verification & Database Inspection

Validate that the active ntds.dit file is operating under the 32k page size architecture:

Step 1: Offline Header Inspection (Maintenance Mode)

# Inspect database header page size
esentutl.exe /mh "C:\Windows\NTDS\ntds.dit" | Select-String "Page Size"

Expected Output:

Page Size: 32768

(If the output displays Page Size: 8192, the database is still on legacy 8k format).

Step 2: Active Directory Optional Feature Verification

Get-ADOptionalFeature -Filter "Name -like '*32k*'" | Select-Object Name, FeatureGUID, EnabledScopes

Expected: EnabledScopes contains the target forest distinguished name (CN=Partitions,CN=Configuration,DC=corp,DC=internal).

Step 3: Replication & Health Check

repadmin /syncall /AdeP
dcdiag /test:Services /v

---

6. Rollback & Contingency Plan

Irreversible Operation

As defined by Active Directory architecture, forest-wide optional features cannot be disabled or rolled back.

1. Pre-requisite Defense: Prior to enabling the Database 32k pages feature in production, full bare-metal or system-state backups of all Domain Controllers must be captured and verified offline (see SOP-SYS-060).
2. Disaster Recovery Rollback: If database corruption occurs during offline page conversion on a specific DC:
   • Do NOT attempt to repair the corrupted ntds.dit.
   • Revert the individual VM to its pre-conversion snapshot, or demote the server forcibly and perform a fresh replica installation from a healthy partner DC via SOP-SYS-002.