I have a problem with RID in my DC (server 2003 enterprise, sp2)
The dcdiag result is this:

Starting test: RidManager
* Available RID Pool for the Domain is 316105 to 1073741823
* win-59aed72cf8.vpgateway.info is the RID Master
* DsBind with RID Master was successful
* rIDAllocationPool is 2605 to 3104
* rIDPreviousAllocationPool is 2605 to 3104
* rIDNextRID: 3104
* Warning :Next rid pool not allocated
* Warning :There is less than 0% available RIDs in the current pool
......................... WIN-59AED72CF8 passed test RidManager

I have set the RID Block size to 10000. I have used LDP to increase the rIDAvailablePool by 200000. I have removed all the stray SRV _ldap._tcp records from the DNS server to make sure I'm using the right RID Master.
Still I can not create users and I get system event IDs 16651 & 16645.
I was creating users by a VBA script in the Excel, which after about 1500 users all of a sudden I started to get errors. At this time, I have 1518 objects (1501 users & the rest are groups) in the users container.
I am logged on as a domain admin.
Is there any work around or fix for this?
Any help is highly appreciated.


  • Did anything unusual happen in your environment recently, like failed or restored DCs? – Dusan Bajic Jan 9 '12 at 15:50
  • No, nothing special has happened here. Everything is smoothly running except this RID... – kazem eghtesad Jan 10 '12 at 0:42

Are you running DC Diag from the RID master? or from another DC? Verify that your DC holding the RID master role is online, replicating, and accessible to the other DCs.

The focus on replication/ communication is because these types of issues generally are related to issues communicating with the RID Master.

Looking at your output, you can see that your RIDAllocationPool matches your RIDPreviousAllocationPool. The RIDAllocationPool should be the NEXT set of RIDs your DC will use (increases by block size when pool reaches 50%, whereas the RIDPreviousAllocationPool is the CURRENT set of RIDS in use.

Your NextRID is equal to your last RID in the current pool, which is why you are getting errors.

Given that you are scripting the creation of user accounts, you may have overwhelmed your RIDMaster and it was unable to generate a new pool. Try rebooting the DC and manually creating a new user.

Also, did you delete the SRV records for your OTHER DCs from your "_tcp.DomainDNSZone" Zone?

If so, you will want to recreate those records by restarting the netlogon service on all your DCs.

| improve this answer | |
  • I ran it on the RID master. The dcdiag shows that the RID master is reachable. I have 3 other DCs but none of them are RID Master, only one RID Master exists – kazem eghtesad Jan 8 '12 at 4:52
  • There should only be one RID master per domain, try the command repadmin /syncall from an Admin CLI to see if there are replication issues – SpacemanSpiff Jan 9 '12 at 16:06
  • It might also be useful to seize the RID master role, and seize it back, if replication is working this might get things moving again. and while it's on my brain make sure time synchronization is working – SpacemanSpiff Jan 9 '12 at 16:12
  • I wouldn't seize the role, it would cause the DC that it was seized from to become nonoperational. I WOULD however, try to transfer the RID master role, to determine if there is some communication failing between your DCs. – HostBits Jan 9 '12 at 16:22
  • 1
    It is quite possible for two separate servers to believe they hold a FSMO role, this is why I asked you to verify replication status and time synchronization before proceeding, I'm certain Microsoft would do the same. From my perspective you don't deserve any more help from me. – SpacemanSpiff Jan 9 '12 at 23:39

When a DC uses up all of it's allocation it needs to ask the rid master FSMO owner for another rid pool. It looks to me liek the error is that the DC cannot commmunicate to the rid master to get another pool. Chanfging the block size will have no effect - I would change that back (and I am curious as to the reason why you thought you should change it). try running: 1. \\RIDmaster\sysvol - where ridmaster is the machine that owns the rid master fsmo role - if that doesn't work your network is hosed 2. repadmin /showrepl dcdiag /test:ridmanager /v the results of this should tell you what wrong.

| improve this answer | |
  • Thanks for your reply. the \\ridmaster\sysvol works perfect and opens the folder. the second command is wrong and is a merge of two separate commands. I have already run the dcdiag and I have pasted the result here above. There is nothing wrong with the RIDmaster. Just there is no more rid pool in the server. – kazem eghtesad Jan 8 '12 at 4:40

I had the same problem and when I executed repadmin /showrepl rIDAllocationPool was changed and started to work. I was able to create users, add computers in the domain... And you don't need to restart the DC server every time you have this problem. You just need to restart Active Directory Domain Service.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.