Networks

Ask something
Question Locked

Server 2k3 AD: exhausted relative identifiers

0 helpful
11 replies

by lord_orochi

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We're running Server 2003 on our college's lab side that handles active directory. Last week, when we tried to add new users the server replied with the following error:
The directory service has exhausted the pool of relative identifiers.
The thing is that it's the RID Master. Just in case, we even tried to seize rid master but it said that it already was the rid master.
Quite frankly, I'm stumped and have no clue about what to do. Can someone give some advice?

11 replies

by lowlands

This message usually indicates that a DC can not contact the DC with the RID master role. I would start with running dcdiag and netdiag on all your DC's to see if any errors pop up.

by lord_orochi

I will run them and see what turns up. Thank for the help!

by lord_orochi

I ran netdiag, dcdiag, and read through the entire logs. The server in question is master and had one other that it replicated with as a backup. I found out that they took the backup down in Dec. and added it back resently. I also found this in the error log on the main server:
This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted. Replication errors are preventing validation of this role.

by dumphrey

off the server before the decommissioned it? That could cause problems when they bring it back.
As a last resort you could try seizing the role on to the main DC, then assign it back to the secondary DC.

by lord_orochi

The main server had the fsmo roles. The secondary server was removed but the main has stopped because it no longer has anyone to replicate with. I tried to seize the roles on the main server but it just told me that it already was the fsmo master. Yet it's still looking to the secondary for the replication.

by dumphrey

RID master role, and it was removed from the network poorly. So now the DC can not add user/computer objects because it has no more "tokens" to assign since the RID master is unavailable. If the primary was RID master, not being able to replicate would not be an issue.
"the secondary server was removed but the main has stopped because it no longer has anyone to replicate with"
AD would continue to work if all roles are/were available, and would log an error in event viewer about the lack of replication. Each AD server is independent/redundant as long as all FSMO roles are available. So, obviously, the RID master is not for some reason.
Now, since you say the primary server claims to have the RID master role, it seems something more unhealthy is going on.

Any error messages in event viewer?

http://technet2.microsoft.com/windowsserver/en/library/42e14233-6edd-4d0a-87bf-b3d0e3f360081033.mspx?mfr=true
May help some in tracking down RID Master problems.
http://technet2.microsoft.com/windowsserver/en/library/42e14233-6edd-4d0a-87bf-b3d0e3f360081033.mspx?mfr=true
in particular.

and
http://technet2.microsoft.com/windowsserver/en/library/42e14233-6edd-4d0a-87bf-b3d0e3f360081033.mspx?mfr=true
"A domain controller whose RID master role has been seized must never be brought back online."

by lord_orochi

Ok...now it seems to be an issue with the dns. =_=" My boss has decided that if the solution cannot be found by the end of the week, then we'll just start the server from scrath.

by lowlands

But if it is only the Domain related entries that are missing, try running netdiag /fix

then check for entries that point to the old dc and remove those.

by lord_orochi

The problem was the secondary DC was removed without changing anything on the primary. So the primary refused to add new users because it couldn't replicate with the secondary that was no longer there. In case anyone searches and finds this, the way to remove the data about the SDC from the PDC is here:
http://support.microsoft.com/default.aspx?scid=kb;en-us;216498
Thanks again everyone!

This discussion is closed to new replies.