Thought I’d doc this for any others who run into this issue. I had to demote/promote a machine this morning and when it finished promoting I found it was missing all the NTDS\* counters in perfmon.
I ran LODCTR /Q and saw that it looked wrong:
C:\Windows\system32>lodctr /q:NTDS Performance Counter ID Queries [PERFLIB]: Base Index: 0x00000737 (1847) Last Counter Text ID: 0x00001792 (6034) Last Help Text ID: 0x00001793 (6035)
Looking into it further I found it was missing the whole performance key:
Once I found that, I exported the performance registry key from another domain controller and imported to the server missing the values and ran LODCTR /R and then the counters were back where they belonged…
C:\Windows\system32>lodctr /q:NTDS Performance Counter ID Queries [PERFLIB]: Base Index: 0x00000737 (1847) Last Counter Text ID: 0x00001794 (6036) Last Help Text ID: 0x00001795 (6037)
[NTDS] Performance Counters (Enabled) DLL Name: %systemroot%\system32\ntdsperf.dll Open Procedure: OpenNtdsPerformanceData Collect Procedure: CollectNtdsPerformanceData Close Procedure: CloseNtdsPerformanceData First Counter ID: 0x000009DE (2526) Last Counter ID: 0x000009DE (2526) First Help ID: 0x000009DF (2527) Last Help ID: 0x000009DF (2527)