Error Message: The Account-Identifier Allocator Failed to Initialize Properly

Article translations Article translations
Article ID: 248410 - View products that this article applies to.
This article was previously published under Q248410
This article has been archived. It is offered "as is" and will no longer be updated.
Expand all | Collapse all

SYMPTOMS

You may receive the following event approximately every two minutes in the NTDS event log:
Event 16650

MessageId=0x410A

SymbolicName=SAMMSG_RID_INIT_FAILURE
Language=English
The account-identifier allocator failed to initialize properly. The record data contains the NT error code that caused the failure. Windows 2000 may retry the initialization until it succeeds; until that time, account creation will be denied on this Domain Controller. Please look for other SAM event logs that may indicate the exact reason for the failure.

CAUSE

This behavior can occur because the RID Master FSMO is unavailable or fails to replicate. The Domain Controller cannot obtain and initialize the RID pool.

This behavior can also occur when the User Right "Access this computer from the network" has not been given to the appropriate groups such as "Enterprise Domain Controllers" or "Authenticated Users".

RESOLUTION

To troubleshoot this behavior, examine the NTDS event log for further detail about the replication failure.

Determine the RID Master FSMO by following the steps in the following Microsoft Knowledge Base article:
234790 How to Find FSMO Role Holders (Servers).
Verify network connectivity by using the ping command. For additional information about how to use the PING command, click the article numbers below to view the articles in the Microsoft Knowledge Base:
169790 How to Troubleshoot Basic TCP/IP Problems in Windows NT 4.0
200525 Using NSlookup.exe


If the RID Master is down for an extended period of time, follow the steps in the following Microsoft Knowledge Base article:
223787 Flexible Single Master Operation Transfer and Seizure Process
.

To add either the "Enterprise Domain Controllers" or "Authenticated Users" group to the right "access this computer from the network", perform the following steps in Domain Controller Security Policy:

Open this policy by clicking Start, then programs, then Administrative Tools, and then Domain Controller Security Policy.Expand the Security Settings to Local Policies, and then to User Rights Assignment.Double click the right "access this computer from the network" and Add either the Everyone or Authenticated Users to this right.
If there are multiple Win2k Domain Controllers, then from a command prompt also run the following command to refresh this change on their policies as well. Run the command without "" marks.

"secedit /refreshpolicy machine_policy /enforce"

Properties

Article ID: 248410 - Last Review: October 22, 2013 - Revision: 3.2
APPLIES TO
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
Keywords: 
kbnosurvey kbarchive kbenv kberrmsg kbnetwork kbprb KB248410

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com