In tip 2003 ยป Backup/Restore the System State on your Windows 2000 server, we see that the Active Directory (NTDS) is backed up when you perform a System State backup on a domain controller.

If you have Directory Synchronization Services installed, passwords are stored in a reversible hashed form, to synchronize with Novell Directory Services.

To protect the passwords, ACLs are employed.

During a System State backup, NTDS.DIT is not controlled by Active Directory, and the ACLs prevent the database from being included in the backup dataset.

This feature is by design.