RID allocation and account-creation failures

A new account needs a new identity

A domain security principal’s SID includes the domain SID and a relative identifier, or RID. The RID master allocates blocks to writable DCs, which use their local allocation when creating principals. If the RID master is temporarily unavailable, DCs with usable local space can keep creating accounts until they need more.

The uniqueness requirement persists after deletion. RIDs successfully used for SIDs must not later be recycled into another principal’s identity. Deleting test accounts is not a way to return their RIDs to the domain. The MS-SAMR RID-generation algorithm defines the range and no-reuse constraints.

This is why live object count and consumed RID space differ. Repeated restore/demotion, discarded pools, failed provisioning patterns and overlarge block settings can consume space without leaving a matching population of live accounts. Investigate the allocator and the caller, not only the number of users.

The documented ordinary block size is 500 RIDs; modern Windows caps an oversized configured block at 15,000 and logs the condition. Increasing the block size changes consumption and allocation frequency, not the health of a broken RPC or replication path. RID block limits and consumption causes.

Establish the scope of the failure

Record the account-creation operation, caller, target DC, domain, time and error. Access denied, duplicate names, schema constraints, an RODC referral and allocator failure need different fixes. Look for the directory status behind a generic application message.

Compare an authorized provisioning operation on the affected writable DC with another appropriate replica. Don’t create hundreds of disposable users just to test health. If only one DC fails, look at its pools, initialization, replication and communication. Domain-wide failure with a ceiling event needs a different decision. Microsoft’s RID troubleshooting sequence.

Read ownership and allocator diagnostics

From an administrative session:

$dc = 'dc1.contoso.com'
Get-ADDomain -Server $dc | Select-Object DNSRoot,RIDMaster

Then collect a verbose RID-manager check against the failing DC:

dcdiag /s:dc1.contoso.com /test:RidManager /v

Retain the available domain pool, reported role holder, local pool ranges, next-RID information and exact test failure. Compare the reported role owner with another healthy replica when disputed. Initial inbound synchronization can prevent an owner from performing its role even when its ownership attribute is present. FSMO readiness and recovery.

Use the DCDiag reference for test prerequisites. A failed allocator RPC path is not repaired by altering the global pool’s numeric value.

Inspect the objects behind the report

The domain RID Manager object and the DC’s RID Set are different objects. Select the RID Set through the DC computer object’s reference instead of constructing its DN from an assumed name:

$domain = (Get-ADRootDSE -Server $dc).defaultNamingContext
$ridManager = 'CN=RID Manager$,CN=System,' + $domain
Get-ADObject -Server $dc -Identity $ridManager `
    -Properties fSMORoleOwner,rIDAvailablePool,'msDS-RIDPoolAllocationEnabled' |
    Format-List DistinguishedName,fSMORoleOwner,rIDAvailablePool,
        'msDS-RIDPoolAllocationEnabled'

$dcInfo = Get-ADDomainController -Identity $dc -Server $dc
$computer = Get-ADObject -Server $dc -Identity $dcInfo.ComputerObjectDN `
    -Properties rIDSetReferences
Get-ADObject -Server $dc -Identity $computer.rIDSetReferences `
    -Properties rIDAllocationPool,rIDPreviousAllocationPool,rIDNextRID |
    Format-List DistinguishedName,rIDAllocationPool,
        rIDPreviousAllocationPool,rIDNextRID

These queries read configuration/state without allocating a pool. If the RID Set/reference is missing, investigate how that happened before changing anything. Don’t create one manually or copy another DC’s values.

Pool attributes encode range components in a large integer; they are not simple remaining-account counts. In particular, rIDPreviousAllocationPool is the range used by the generation algorithm despite its misleading name. A different rIDAllocationPool can supply the next range when the active one is consumed. Prefer the decoded DCDiag output unless applying the documented representation correctly. Protocol field/transition semantics.

Read events as allocator state transitions

On the failing DC and RID master, inspect allocator events with their provider and channel. Microsoft’s RID documentation names both System and Directory Service for these events, so collect both rather than assuming the channel from the number alone:

Get-WinEvent -ComputerName $dc -FilterHashtable @{
    LogName = 'System','Directory Service'
    Id = 16645,16650,16651,16653,16654,16655,16656,16657,16658
    StartTime = (Get-Date).AddDays(-7)
} | Where-Object ProviderName -match 'Directory-Services-SAM|SAM' |
    Select-Object TimeCreated,LogName,Id,ProviderName,Message

Read the complete messages and provider. Microsoft introduced these monitoring/ceiling behaviors in Server 2012; its current RID issuance guide documents the conditions. Normal restored-VM pool invalidation is different from unexplained repeated invalidations.

A safety ceiling is not total exhaustion

The RID master’s protection stops new block issuance before all domain space is consumed. DCs can still consume outstanding allocations, so success on one DC does not prove the ceiling is absent. Inspect msDS-RIDPoolAllocationEnabled with the ceiling event and role-holder state. An unset property is not the same as an explicit False value.

Overriding the ceiling and expanding the global namespace are separate changes. Find and stop runaway consumption first. Microsoft’s documented expansion can’t be reversed with an ordinary attribute edit and can affect compatibility. An old domain doesn’t automatically need expansion, and a registry/RootDSE recipe for it doesn’t belong in a recurring health script.

Restore and seizure consume space deliberately

Restored DCs discard pools to avoid issuing identities already consumed after the backup. RID-master seizure also reserves additional space, with tool-specific behavior. Repeatedly invalidating pools or seizing a role while debugging wastes the very resource being protected. Use the role recovery procedure to decide whether transfer or seizure is required and what happens to the former owner.

Forest recovery has a deliberate RID-pool raising procedure to avoid reusing identities from the lost interval. That is a recovery step in a coordinated isolated plan, not a general fix for an ordinary DC allocation error.

Validate the allocator and the provisioning path

After repair, repeat DCDiag and the relevant replication/connectivity checks, then try the intended authorized provisioning operation. Check the resulting identity and its replication. Keep watching allocations and events to make sure the pool replenishes normally and the caller isn’t consuming space unexpectedly. One successful account creation may have used the last local RID.