We have a problem with one of our AD: Creating a new object will instead delete another object.
In one of the DC, we have this message logged:
"There are two or more objects that have the same SID attribute in the SAM database"
This AD was recently cloned during a site migration: we cloned the original AD (all machines) into the new one and ran it in parallel while running tests (these two AD aren't actually connected in any way). We performed incremental update of the file server data (using a "bridge" machine on the new infrastructure that is the only one that can connect to both locations, is not a DC and can't connect to the DC on the old infrastructure).
Now, we had this happened twice: creating a new object (any object: user, group, computer account, etc.) results in the object being created with the same SID as an existing object, at wich point both objects are immediately being deleted. We found that out because a newly created file server was suddently deleted from the domain when we attempted to create a new user account (we had to re-add it to the domain)
Now, we have tried to invalidate the RID pool on both DCs but that did not seem to solve the issue.
We exported all SIDs from the AD and found the higest one: S-1-5-21-XXXXXX-XXX-XXXXX-7601
Then we checked our DCs using
Dcdiag.exe /TEST:RidManager /v and, on the RID master, we had this:
* rIDAllocationPool is 7600 to 8099 The DS has corrupt data: rIDPreviousAllocationPool value is not valid * rIDPreviousAllocationPool is 0 to 0 * rIDNextRID: 0 No rids allocated -- please check eventlog.
So: first, we have the
The DS has corrupt data: rIDPreviousAllocationPool value is not valid message. I can't tell if it's because we haven't allocated a new object since the RID has been reset or if it's a real error. What's certain is that there is no error in the event log, only the informational message about the RID pool being invalidated.
Second, the rIDAllocationPool does start at 7600 which hints at the fact that the next object to be created will most likely use RID 7600 which is inferior to the currently higher 7601 SID, potentially leading to a deletion problem (and since the object with RID 7601 is the file server that we had to re-add it to the AD, it will cause many issues).
So: beside the fact that I have no idea how we could have ended up with such a problem since we never restired the AD to a previous state, how can I fix it ?