ntdsperf.dll errors usually appear as:
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Windows cannot load the extensible counter DLL
C:Windowssystem32ntdsperf.dll.
You may also see:
The system cannot find the file specified.
The 60-second answer
ntdsperf.dll is a Microsoft Windows Server performance-counter component associated with Active Directory Domain Services. It is not a Visual C++ runtime, DirectX file, game dependency, or general-purpose application DLL.
As an Amazon Associate I earn from qualifying purchases.
On Windows Server 2019 and 2022, Event ID 1023 from Microsoft-Windows-Perflib can be caused by a stale reference to this file under the NTDSPerformance registry key. Microsoft states that this stale reference does not harm normal operating-system function, although it can prevent Active Directory Diagnostics from collecting data.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInstall the latest applicable Windows updates first. If the only remaining symptom is Event ID 1023, export and rename the stale performance-counter key. Use DISM and SFC when the file should exist on that Windows build but is missing or damaged.
#1 Best Overall
If you are using Windows 10 or Windows 11 and a random application claims that ntdsperf.dll is missing, do not immediately download the DLL. The message may be generic or may identify the wrong cause. The documented evidence for this file concerns Windows Server, domain controllers, Perflib, and Active Directory Diagnostics.
What ntdsperf.dll does
Windows performance counters allow tools such as Performance Monitor and diagnostic data collectors to obtain measurements from system services. A legacy performance provider is configured through a registry key containing values such as:
Library, which identifies the performance DLLOpen,Collect, andClose, which identify exported counter functions
The relevant registration is:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNTDSPerformance
NTDS refers to Active Directory Domain Services. The associated file is normally referenced as:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
C:WindowsSystem32ntdsperf.dll
That explains why the error is normally seen on Windows Server systems, especially domain controllers, rather than on ordinary consumer PCs.
Historical Windows Server 2012 R2 records show separate x64 and x86 versions of the file. Their version and size are specific to that operating-system release, so those values must not be treated as universal requirements for Windows Server or Windows 10 and 11. Microsoft’s Windows Server 2012 R2 file list provides that historical information.
Is the error dangerous
Usually, an isolated Event ID 1023 entry is a performance-counter warning, not an application crash. It does not automatically mean that Active Directory is broken.
Treat it more seriously when:
- Active Directory Diagnostics also fails
- domain-controller services show other errors
- the server recently failed to install an update
- system files are missing or corrupted
- the
NTDSPerformanceregistry data was manually changed - antivirus software quarantined the file
Microsoft documented a Windows Server 2019 issue where Active Directory Diagnostics could return “The system cannot find the file specified.” The fix was included in KB4516077.
Fix 1: Install current Windows updates
This is the safest first step, particularly on Windows Server 2019 or 2022.
- Sign in with an administrator account.
- Open Start and select Settings.
- Select Windows Update.
- Select Check for updates.
- Install all applicable cumulative and servicing updates.
- Restart the server when Windows requests it.
- Run the diagnostic collection or check Event Viewer again.
On older Windows Server interfaces:
- Open Control Panel.
- Select System and Security.
- Select Windows Update.
- Select Check for updates.
- Install the available updates and restart.
If Active Directory Diagnostics now runs and no new Perflib event appears, the update resolved the issue. If Event ID 1023 remains but diagnostics and the server operate normally, continue with the stale-registration procedure below.
Fix 2: Repair Windows components with DISM and SFC
Use this route when ntdsperf.dll should be present for the exact Windows build but is missing, corrupted, or suspected to have been removed by failed servicing.
Open an elevated Command Prompt:
- Open Start.
- Type
cmd. - Right-click Command Prompt.
- Select Run as administrator.
- Select Yes at the User Account Control prompt.
Run DISM first:
DISM.exe /Online /Cleanup-Image /RestoreHealth
Wait for it to finish. Then run System File Checker:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchessfc /scannow
Restart the computer or server after both commands complete.
A successful result is one of these:
- DISM reports that the restore operation completed successfully.
- SFC reports that it found no integrity violations.
- SFC reports that it found corrupt files and successfully repaired them.
If SFC repaired files, restart and check Event Viewer again. If SFC reports that it could not repair some files, inspect:
%windir%LogsCBSCBS.log
Microsoft’s DISM repair guidance and System File Checker documentation explain these repair tools.
Repeating DISM and SFC without knowing which component is damaged can waste time. Outbyte PC Repair can scan for the specific Windows problems involved; its free scan shows what it finds, while repair actions are handled by the full version.
If DISM cannot obtain repair files from Windows Update, use a matching installation source:
DISM.exe /Online /Cleanup-Image /RestoreHealth /Source:\serverc$windows /LimitAccess
The source must closely match the affected operating-system version and architecture. Do not use an arbitrary Windows image. If repair still fails, use System Restore where available or plan a Windows Server in-place repair after backing up the domain controller and confirming directory-services recovery procedures.
Fix 3: Rename the stale NTDS performance key
Use this procedure when all of the following apply:
- the server is Windows Server 2019 or 2022
- the remaining symptom is Event ID 1023 or a similar Perflib warning
- Windows updates are installed
- Active Directory and the server otherwise operate normally
Microsoft’s guidance does not say to apply this procedure to every Windows version. It also states that the key is not present by default on Windows Server 2025.
Rank #3
Before changing the registry, export the key:
- Press Win + R.
- Type
regedit. - Press Enter.
- Approve the administrator prompt.
- Navigate to:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNTDSPerformance
- Right-click the
Performancekey. - Select Export.
- Save the
.regfile somewhere accessible to an administrator. - Right-click
Performance. - Select Rename.
- Rename it to:
Performance_
- Restart the server, or wait for the next performance-counter collection.
Check Event Viewer after the restart. If the obsolete reference caused the warning, new Event ID 1023 entries should stop.
Do not delete the key before exporting it. If another diagnostic or monitoring tool later requires the registration, you can restore the exported key by double-clicking the .reg file, subject to your organization’s change-control procedures.
Fix 4: Check whether security software quarantined the file
Antivirus quarantine is possible, but it is not established as the usual cause of this particular error.
- Open your organization’s antivirus or endpoint-security console.
- Review quarantine and detection history.
- Search for
ntdsperf.dll. - Check whether the detected path was actually the Windows directory.
- Verify that the file belongs to the matching Microsoft Windows image before restoring anything.
- Run Microsoft Defender or your approved security scan.
Do not restore a suspicious copy merely because its filename matches. A replacement must match the Windows build, architecture, signature, and servicing state.
Free tools Windows power users keep installed
One-click scans. No signup required.
Fix 5: Check the registration instead of registering the DLL
You can inspect the registry reference without changing it:
- Press Win + R.
- Enter
regedit. - Open:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesNTDSPerformance
- Review the
Libraryvalue. - Confirm whether it references
ntdsperf.dll. - Export the key before making any correction.
A performance-counter provider is loaded through its Performance registry configuration and exported counter functions. It is not generally installed by running a registration command.
Do not use:
regsvr32 ntdsperf.dll
regsvr32 is intended for DLLs that expose registration functions such as DllRegisterServer. It is not the correct repair for this performance-counter provider. Microsoft documents the distinction in its performance extension DLL guidance and regsvr32 documentation.
Fix 6: Reinstall or update a monitoring product only if it owns the reference
If the full Event Viewer XML identifies another service, monitoring agent, or management product, repair that product through its official administrator console or installer.
Recommended Free Tools
Do not use Windows Features to add a random DLL. ntdsperf.dll is not a standalone optional runtime, and enabling unrelated features will not rebuild an NTDS performance registration.
Rank #4
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Likewise, Device Manager is not normally relevant. This file is not a hardware driver. Only investigate drivers if the same incident includes hardware errors, failed storage operations, or a monitoring agent that installs kernel or device components.
When a driver really is part of the wider failure, update it through the hardware manufacturer or your organization’s approved source. Outbyte Driver Updater can scan for outdated drivers and show what needs attention; the free scan identifies issues, while driver installation is handled by the full version.
Do not download ntdsperf.dll from a DLL website
Avoid downloading an isolated copy from a DLL-collection site or copying one from another computer. That can introduce:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- malware
- the wrong Windows version
- the wrong architecture
- invalid signatures
- missing dependencies
- a stale or incompatible performance-counter registration
Use Windows Update, a matching Windows installation source, DISM, SFC, or an official Windows Server repair process instead. On a domain controller, do not copy an x86 DLL into System32 or an x64 DLL into SysWOW64.
If the error continues
Collect the complete event details rather than relying only on the short message:
- Open Event Viewer.
- Expand Windows Logs.
- Select Application.
- Find Microsoft-Windows-Perflib, Event ID 1023.
- Open the event.
- Select Details.
- Select XML View.
- Save the event or copy its contents.
Then check:
- whether the server is 2019, 2022, or 2025
- whether it is a domain controller
- whether the error began after an upgrade, failed cumulative update, promotion, demotion, or monitoring change
- whether
NTDSPerformanceexists - whether the file exists at
%windir%System32ntdsperf.dll - whether Active Directory Diagnostics actually fails
If the registry key is absent, the file exists, and Event ID 1023 continues, look for another NTDS performance registration or a third-party monitoring product. If DISM and SFC fail, use a matching repair source or an in-place Windows Server repair after protecting the domain controller.
FAQ
Is ntdsperf.dll a virus?
The filename belongs to a genuine Microsoft Windows Server performance component, but any file can be replaced or impersonated. Verify its path, signature, and Windows source rather than trusting the filename alone.
Should every Windows 10 or Windows 11 computer have it?
No universal file inventory is established here for every Windows release. The documented scenario concerns Windows Server and Active Directory performance counters. A generic desktop application message should be investigated by identifying the application that produced it.
Does a missing ntdsperf.dll mean Active Directory is broken?
No. An isolated stale-reference Event ID 1023 does not automatically indicate Active Directory failure. If Active Directory Diagnostics fails or other domain-controller symptoms appear, update and repair the server rather than merely suppressing the event.
Is renaming Performance safe?
Microsoft documents exporting and renaming the key for Windows Server 2019 and 2022 when only the stale Perflib event remains. Do not apply the procedure indiscriminately to every Windows version, and always save a registry export first.
Can I fix it with System Restore?
System Restore may help when the problem followed a recent system change and restore points are available. On a domain controller, back up the server and confirm directory-services recovery procedures before using major repair operations.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
