Looking around I found some information regarding NTDS.dit encryption and I wanted to learn a little bit more around the BOOTKEY and whether this is rotated each boot up sequence or is just held static? Or is it changed every 30 days or so?
If a Domain Controller were to completly fail then I would also assume that you would need a full machine restore since the PEK key is encrypted with a unique BOOTKEY as per each domain controller? Below is information I found from Microsoft Forum:
The PEK or Password Encryption Key is used to encrypt data stored in NTDS.DIT. This key is the same across the whole domain, which means that it is the same on all the domain controllers.
The PEK itself is also stored in the NTDS.DIT in an encrypted form. The PEK is encrypted with the BOOTKEY which is different on all domain controllers (and in fact on all computers in the domain).
The SYSKEY are used to drive the PEK (Password Encryption Key) that in its turn are used to encrypt sensitive information inside the Active Directory database (NTDS.dit) – Not the entire DB is protected by the PEK on certain information such as Password Hashes etc.
