In tip 2003 » Backup/Restore the System State on your Windows 2000 server, we see that the Active Directory (NTDS) is backed up when you perform a System State backup on a domain controller.
If you have Directory Synchronization Services installed, passwords are stored in a reversible hashed form, to synchronize with Novell Directory Services.
To protect the passwords, ACLs are employed.
During a System State backup, NTDS.DIT is not controlled by Active Directory, and the ACLs prevent the database from being included in the backup dataset.
This feature is by design.