| Previous | Next |
| ERROR_DS_OFFSET_RANGE_ERROR | ERROR_DS_ROOT_MUST_BE_NC |
ERROR_DS_RIDMGR_DISABLED
The RID manager has intentionally stopped issuing account identifiers
Windows includes a protection mechanism for severe RID consumption. Microsoft documents warning and error events that activate a ceiling-based safeguard when the remaining global RID space falls below configured thresholds. Once activated, new security-principal creation is blocked until an administrator evaluates the condition and explicitly re-enables RID allocation on the RID master.
Treat this as a protective state, not as a service that merely needs restarting. Review the full RID event sequence on the RID master, determine why the domain consumed so much RID space, and verify there is no unexpected automation or recovery pattern burning pools. The supported re-enable procedure should be performed only after the cause is understood; otherwise the domain can continue consuming a finite identifier namespace.
What to inspect
- Read Directory-Services-SAM events 16656 and 16657 on the RID master.
- Account for current and historical RID consumption before re-enabling allocation.
- Verify the RID master is healthy and replicated before changing the protection state.
References
- Microsoft: managing RID issuance
- Microsoft: Active Directory FSMO roles
- Microsoft: RID allocator initialization failures
Looking for a different code? Search another status or error code.