Description of RID Attributes in Active Directory
This article was previously published under Q305475
This article has been archived. It is offered "as is" and will no longer be updated.
This article describes RID-related attributes in Active Directory.
Users, computers, and groups (collectively known as "security principals") that are stored in Active Directory are assigned Security Identifiers (SIDS), which are unique alphanumeric numeric strings that map to a single object in the domain. SIDS consist of a domain-wide SID concatenated with a monotonically-increasing relative identifier (RID) that is allocated by each Windows 2000 domain controller in the domain. Each Windows 2000 domain controller is assigned a pool of RIDs by the RID flexible single-master operations (FSMO) owner in each Active Directory domain. The RID FSMO is responsible for issuing a unique RID pool to each domain controller in its domain.
RID Attributes in Active Directory
- FsmoRoleOwnerDN path: CN=RID Manager$,CN=System,DC=domain,DC=comPoints to Domain Name path of the current RID masters NTDS Settings object according to domain controller that is being queried.
- RidAvailablePoolDN path: CN=RID Manager$,CN=System,DC=domain,DC=comGlobal RID space for an entire domain is defined in Ridmgr.h. as a large integer with upper and lower parts. The upper part defines the number of security principals that can be allocated per domain (0x3FFFFFFF or just over 1 billion). The lower part is the number of RIDs that have been allocated in the domain. To view both parts, use the Large Integer Converter command in the Utilities menu in Ldp.exe.
- Sample Value: 4611686014132422708 (Insert in Large Integer Calculator in the Utilities menu of Ldp.exe)
- Low Part: 2100 (Beginning of next RID pool to be allocated)
- High Part: 1073741823 (Total number of RIDS that can be created in a domain)
- RidAllocationPoolDN Path: CN=Rid Set,Cn=computername,ou=domain controllers,DC=domain,DC=COMEach domain controller has two pools: the one that they are currently acting on, and the pool that they will use next. It is the next pool, which is allocated by the RID FSMO, that will be used for creation of security principals in the domain when the current pool is exhausted. Use the Large Integer Converter command in the Utilities menu in Ldp.exe to view both pools.
- Sample Value: 685485370535295 (Insert in Large Integer Calculator in Utilities menu of Ldp.exe)
- Low Part: 159103 (Beginning RID in the next RID pool)
- High Part: 159602 (Ending RID in the next RID pool)
- RidNextRidDN Path: CN=Rid Set,Cn=computername,ou=domain controllers,DC=domain,DC=COMThe RID that was assigned to the last security principal that was created on the local domain controller. RidNextRid is a non-replicated value in Active Directory.
- Sample Value: 159345 (RID assigned to the last created security principal from the RidPreviousAllocationPool)
- RidPreviousAllocationPoolDN Path: CN=Rid Set,Cn=computername,ou=domain controllers,DC=domain,DC=COMThe pool from which RIDs are currently taken. The value for RidNextRid is implicitly a member of this pool. Use the Large Integer Converter command in the Utilities menu in Ldp.exe to view the beginning and ending RIDS in the current pool. RidPreviousAllocationPools is a non-replicated value in Active Directory.
- Sample Value: 687632854183795 (Insert in Large Integer Converter command in the Utilities menu of Ldp.exe)
- Low Part: 159,603 (Beginning RID in next RID pool)
- High Part: 160,102 (Ending RID in next RID pool)
- RidUsedPoolDN Path: CN=Rid Set,Cn=computername,ou=domain controllers,DC=domain,DC=COMUnused attribute
- NextRidDN Path: DC=domain,DC=COMUnused attribute
Article ID: 305475 - Last Review: 12/06/2015 04:40:43 - Revision: 3.0
Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server, Microsoft Windows 2000 Datacenter Server
- kbnosurvey kbarchive kbenv kbinfo KB305475