Error Message: The Account-Identifier Allocator Failed to Initialize Properly
This article was previously published under Q248410
This article has been archived. It is offered "as is" and will no longer be updated.
You may receive the following event approximately every two minutes in the NTDS event log:
Language=EnglishThe account-identifier allocator failed to initialize properly. The record data contains the NT error code that caused the failure. Windows 2000 may retry the initialization until it succeeds; until that time, account creation will be denied on this Domain Controller. Please look for other SAM event logs that may indicate the exact reason for the failure.
This behavior can occur because the RID Master FSMO is unavailable or fails to replicate. The Domain Controller cannot obtain and initialize the RID pool.
This behavior can also occur when the User Right "Access this computer from the network" has not been given to the appropriate groups such as "Enterprise Domain Controllers" or "Authenticated Users".
To troubleshoot this behavior, examine the NTDS event log for further detail about the replication failure.
Determine the RID Master FSMO by following the steps in the following Microsoft Knowledge Base article:
234790 How to Find FSMO Role Holders (Servers).Verify network connectivity by using the ping command.For additional information about how to use the PING command, click the article numbers below to view the articles in the Microsoft Knowledge Base:
169790 How to Troubleshoot Basic TCP/IP Problems in Windows NT 4.0
200525 Using NSlookup.exe
If the RID Master is down for an extended period of time, follow the steps in the following Microsoft Knowledge Base article:
223787 Flexible Single Master Operation Transfer and Seizure Process.
To add either the "Enterprise Domain Controllers" or "Authenticated Users" group to the right "access this computer from the network", perform the following steps in Domain Controller Security Policy:
Open this policy by clicking Start, then programs, then Administrative Tools, and then Domain Controller Security Policy.Expand the Security Settings to Local Policies, and then to User Rights Assignment.Double click the right "access this computer from the network" and Add either the Everyone or Authenticated Users to this right.If there are multiple Win2k Domain Controllers, then from a command prompt also run the following command to refresh this change on their policies as well. Run the command without "" marks.
"secedit /refreshpolicy machine_policy /enforce"
Article ID: 248410 - Last Review: 10/22/2013 03:59:14 - Revision: 3.2
Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server
- kbnosurvey kbarchive kbenv kberrmsg kbnetwork kbprb KB248410