{"id":957,"date":"2007-12-04T23:48:51","date_gmt":"2007-12-04T23:48:51","guid":{"rendered":"http:\/\/www.markwilson.co.uk\/blog\/2007\/12\/active-directory-and-relative-identifiers.htm"},"modified":"2007-12-04T23:48:51","modified_gmt":"2007-12-04T23:48:51","slug":"active-directory-and-relative-identifiers","status":"publish","type":"post","link":"https:\/\/www.markwilson.co.uk\/blog\/2007\/12\/active-directory-and-relative-identifiers.htm","title":{"rendered":"Active Directory and relative identifiers"},"content":{"rendered":"

Last night, I wrote a post about how a little logical thinking was required in order to resolve some issues<\/a> with the dcdiag.exe<\/code> utility from the Windows Server 2003 Support Tools.<\/p>\n

Since then, I’ve been examining the dcdiag test results and was a little alarmed to find that two of the domain controllers (DCs) for the domain that I intend to migrate several hundred users into were reporting a lack of available RIDs:<\/p>\n

Starting test: RidManager
   * Available RID Pool for the Domain is 17352 to 1073741823
   * <\/em>domaincontrollername.<\/em>domainname.<\/em>tld is the RID Master
   * DsBind with RID Master was successful
   * rIDAllocationPool is 14352 to 14851
   * rIDPreviousAllocationPool is 12352 to 12851
   * rIDNextRID: 12849
   * Warning :There is less than 1% available RIDs in the current pool
   …………………….<\/em> domaincontrollername passed test RidManager<\/em><\/p>\n

For anyone who doesn’t appreciate the potential significance of this, relative identifiers (RIDs) are necessary in order to create new Active Directory objects.  Because Active Directory uses a multi-master model, any DC can create an object, which is then replicated between the various DCs in the organisation.  Objects are actually identified by their SID, part of which includes the domain identifier, and part of which is the RID.  In order to maintain uniqueness, the generation and allocation of RIDs is controlled by the DC holding the RID Master role for the domain, allocating pools of 500 (by default) RIDs to DCs for use when generating the SIDs for new objects.  Still with me?  Microsoft knowledge base article 305475<\/a> has more details.<\/p>\n

Active Directory DCs (at Windows 2000 SP4 and later revisions) request a new RID pool from the RID master once the pool is 50% depleted, so 1% of available RIDs concerned me somewhat.  Other tests had confirmed that replication was working, and switching the RID Master role to another DC didn’t appear to make any change.  I also checked to see that there were no duplicate SIDs in the domain<\/a>.  As it happens, everything was working normally but the labels, and the warning, are very confusing. This is what I found:<\/p>\n