This article was previously published under Q248410
This article has been archived. It is offered "as is" and will no longer be updated.
You may receive the following event approximately every two minutes in the NTDS event log:
The account-identifier allocator failed to initialize properly. The record data contains the NT error code that caused the failure. Windows 2000 may retry the initialization until it succeeds; until that time, account creation will be denied on this Domain Controller. Please look for other SAM event logs that may indicate the exact reason for the failure.
This behavior can occur because the RID Master FSMO is unavailable or fails to replicate. The Domain Controller cannot obtain and initialize the RID pool.
This behavior can also occur when the User Right "Access this computer from the network" has not been given to the appropriate groups such as "Enterprise Domain Controllers" or "Authenticated Users".
To troubleshoot this behavior, examine the NTDS event log for further detail about the replication failure.
Determine the RID Master FSMO by following the steps in the following Microsoft Knowledge Base article:
Verify network connectivity by using the ping command.For additional information about how to use the PING command, click the article numbers below to view the articles in the Microsoft Knowledge Base:
169790 How to Troubleshoot Basic TCP/IP Problems in Windows NT 4.0
If the RID Master is down for an extended period of time, follow the steps in the following Microsoft Knowledge Base article:
223787 Flexible Single Master Operation Transfer and Seizure Process
To add either the "Enterprise Domain Controllers" or "Authenticated Users" group to the right "access this computer from the network", perform the following steps in Domain Controller Security Policy:
Open this policy by clicking Start, then programs, then Administrative Tools, and then Domain Controller Security Policy.Expand the Security Settings to Local Policies, and then to User Rights Assignment.Double click the right "access this computer from the network" and Add either the Everyone or Authenticated Users to this right.
If there are multiple Win2k Domain Controllers, then from a command prompt also run the following command to refresh this change on their policies as well. Run the command without "" marks.