Windows Server 2019 Event ID 1023 cannot locate module ntdsperf.dll

Copper Contributor

Hello to all,


My server continuously posts Event ID 1023 in the application event log. It states that it is unable to locate the ntdsperf.dll file. The file does not exist on the server. I have performed a search at the server's command prompt and searched Google and Bing. The file does not exist on the Windows Server 2019 original media disc. The server is strictly a domain controller and updated with the latest Windows Updates. The error doesn't appear to be critical, and some posts state to ignore it. I would prefer to eliminate the error if possible. I've not found any community posts or patches directly from Microsoft to obtain the file.


Any recommendations are appreciated. Thank you.

13 Replies

From Server Manager scroll down to Performance, right-click the perf object and choose Stop Counter  



@steve1585 just checking if there's any progress or updates? please don't forget to mark helpful replies.  



Hello Dave,

I apologize for the delayed response. My server manager encompasses all the servers on the network. The event ID 1023 that is posted within the application event log and not the Server Manager. It doesn't show up as an error within the Server Manager. The performance section for all listed roles and groups in Server Manager has no errors. Nothing is red. Please let me know if I am not providing enough clarity. Thank you!
best response confirmed by steve1585 (Copper Contributor)
My server manager encompasses all the servers on the network. 

Try clicking here to manage the local instance.   



@Dave Patrick The event ID specifically states, "Windows cannot load the extensible counter DLL C:\Windows\system32\ntdsperf.dll. The specified module could not be found." I'm thinking this is not an important event. It appears to be a common issue. I've looked on the server, and the nsdsperf.dll file is not on the system, nor does SFC report any errors.




100% agree that it's not important. Try right-clicking and stop the counter.  



Where would that be located? It's not in the Performance section.

I believe I can see it in your screenshot?   






The graphic with the black blot is the server name with the "counter status" set to Off. There are no other items within the section.

Ok, in the screenshot it shows as On so hopefully that solves it.  



OK. Got it. I was looking at the wrong server. Oops. Thank you. I will monitor it for a little bit and get back. Thanks very much for your assistance!

@steve1585 sounds good, please don't forget to close up the thread here by marking a best response.  



You bet, sir. Thanks again!