RID Master Role in Windows 2000 Active Directory

This article explains the function of the Relative Identifier (RID) Master in Microsoft Windows 2000 Active Directory, focusing specifically on how it enables account creation. It covers the structure of Security Identifiers (SIDs), the mechanism of RID pool allocation across domain controllers, and the impact on administrative operations when the RID Master becomes unavailable.

Security Identifiers and the RID Component

Every security principal created in Windows 2000 Active Directory—such as user accounts, computer accounts, and security groups—must have a globally unique Security Identifier (SID). Active Directory uses SIDs to track permissions, group memberships, and access rights.

A SID consists of two parts:

  1. Domain SID: A fixed identifier that is identical for every object created within that specific domain.
  2. Relative Identifier (RID): A variable, unique numerical value appended to the end of the Domain SID to distinguish one object from another.

When combined, the Domain SID and the RID form a complete, unique SID (for example, S-1-5-21-...-1004).

The Role of the RID Master in Account Creation

Windows 2000 Active Directory utilizes a multi-master replication model, meaning administrators can create accounts on any Domain Controller (DC) in the domain. To prevent two different DCs from assigning the exact same SID to different accounts created simultaneously, Active Directory relies on the RID Master.

The RID Master is a domain-specific Flexible Single Master Operation (FSMO) role. Its primary responsibilities during account creation include:

  • Centralized Allocation: The RID Master holds the global pool of available RIDs for the entire domain.
  • Pool Distribution: Rather than contacting the RID Master every time an individual account is created, each DC requests a block of RIDs in advance. In Windows 2000, the RID Master allocates these in pools of 500 RIDs at a time to each DC.
  • Local Assignment: When a user or group is created on a DC, that DC pulls the next available RID directly from its local pool and assigns it to the new object.
  • Replenishment: When a DC's local pool falls below a certain threshold (typically around 100 remaining RIDs), it contacts the RID Master to request a new allocation of 500 RIDs.

Operational Impact of RID Master Availability

Because of the local caching mechanism, the RID Master does not need to be online for every individual account creation:

  • Normal Operation: As long as a DC has unassigned RIDs remaining in its local pool, it can successfully create new user, group, and computer accounts without communicating with the RID Master.
  • Pool Depletion: If the RID Master is offline or unreachable across the network and a DC completely exhausts its local pool of 500 RIDs, that specific DC can no longer create any new security principals. Administrators attempting to add an account on that DC will receive an error indicating that the directory service cannot allocate an identifier.
  • Resolution: Account creation resumes as soon as the RID Master returns online and issues a new pool, or if an administrator forces the creation on a different DC that still has RIDs available in its local cache.