Active Directory Domain Services (AD DS) assigns unique security identifiers (SIDs) to users, computers, groups, and trusts that are created in Active Directory. SIDs consist of a domain prefix concatenated with a monotonically increasing relative identifier (RID). Each Active Directory domain is assigned a global RID pool that consists of 1 billion RIDs. To enable each Active Directory domain controller to create new security principals, each domain controller is allocated current and standby RID pools from the RID master.
When the global RID pool for the domain and for the local pools on individual domain controllers in a domain is exhausted, additional users, computers, and groups can no longer be created in the domain. To work around this issue, you can create and migrate objects and applications to a new domain.
This article describes a condition in which a logic failure may result in too many RID pool requests. This leads to global RID pool exhaustion.
When the global RID pool for the domain and for the local pools on individual domain controllers in a domain is exhausted, additional users, computers, and groups can no longer be created in the domain. To work around this issue, you can create and migrate objects and applications to a new domain.
This article describes a condition in which a logic failure may result in too many RID pool requests. This leads to global RID pool exhaustion.