How can we fix AD CS database fragmentation ?

Syafiq Hamid 40 Reputation points
2026-09-11T07:32:27.7066667+00:00

I’ve run into a situation where our issuing CA is taking nearly 30 seconds to issue each certificate, which is slowing down operations significantly. I discovered that the underlying Jet database indexes have become fragmented, causing performance degradation. When processing a batch of certificate requests for a large enterprise deployment, the delay compounds quickly and impacts service availability. I tried basic maintenance steps like restarting services and checking disk I/O, but the issue persists.

The technical challenge here is figuring out how to safely perform offline database index defragmentation using esentutl /d on the AD CS databases without risking corruption or downtime.

Has anyone dealt with this kind of fragmentation before, and what’s the recommended process to restore performance while keeping the CA stable ?

Windows for business | Windows 365 Enterprise
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Hoang Le 4,665 Reputation points Independent Advisor
    2026-09-11T08:06:27.4333333+00:00

    Hello Syafiq Hamid,

    The delay you are seeing on your issuing CA is indeed consistent with heavy fragmentation in the AD CS Jet database. The supported way to address this is to perform an offline defragmentation using esentutl /d against the certsrv.mdb file, but it must be done with the CA service fully stopped to avoid corruption. The process is to stop the Active Directory Certificate Services service, take a verified backup of %systemroot%\System32\CertLog\certsrv.mdb and its log files, then run esentutl /d certsrv.mdb /s <system path> /l <log path> from an elevated prompt. This compacts and rebuilds the indexes, producing a new database file. Once complete, restart the CA service and validate issuance speed.

    It is critical not to run esentutl /d while the CA is online, as that will break transaction consistency. Also ensure you have sufficient free disk space, since the defragmentation process creates a temporary copy of the database. After the operation, monitor the CA event logs and test issuance latency to confirm improvement. If you are in a clustered or highly available CA setup, schedule downtime carefully and replicate the procedure across all nodes. This is the Microsoft‑supported method to restore performance when Jet index fragmentation impacts AD CS.

    If my answer is useful for you, please hit Accept the answer to support me.

    Thank you,

    HL.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.