title: 2 ntds.dit files in Windows Server 2008 R2 and Active Directory logging
body: <p>Why is there 2 files named ntds.dit. 
  <strong>C:\Windows\NTDS\ntds.dit</strong> and <strong>C:\Windows\System32\ntds.dit</strong>? Is there any difference between them?
  Another question, are changes to AD written to edb.log are equivalent to entries stored in <strong>System32\Winevt\Logs\Security.evtx</strong>?</p>