{"id":512,"date":"2012-11-17T15:17:15","date_gmt":"2012-11-17T20:17:15","guid":{"rendered":"http:\/\/adsecurity.org\/?p=512"},"modified":"2014-11-13T22:15:08","modified_gmt":"2014-11-14T03:15:08","slug":"windows-2012-rid-management","status":"publish","type":"post","link":"https:\/\/adsecurity.org\/?p=512","title":{"rendered":"Windows 2012 RID Management"},"content":{"rendered":"

While \u201c1 Billon RIDs should be enough for anyone,\u201d there are scenarios where a domain could run out of RIDs. This is a \u201cvery bad thing\u201d since every security principal requires a RID for creation (Domain SID + RID = security principal SID).\u00a0 One can check the number of RIDs remaining in a domain through many different tools (PowerShell<\/a>).<\/p>\n

DCDIAG:<\/p>\n

Dcdiag.exe \/TEST:RidManager \/v | find \/i \u201cAvailable RID Pool for the Domain\u201d<\/p><\/blockquote>\n

 <\/p>\n

########################
\n# Get Domain RID Info #
\n#######################
\n## Based on code From https:\/\/blogs.technet.com\/b\/askds\/archive\/2011\/09\/12\/managing-rid-pool-depletion.aspx
\nImport-Module ActiveDirectory
\nWrite-Verbose \u201cGet RID Information from AD including the number of RIDs issued and remaining `r \u201c
\n$RIDManagerProperty = Get-ADObject \u201ccn=rid manager$,cn=system,$ADDomainDistinguishedName\u201d -property RIDAvailablePool -server ((Get-ADDomain $DomainDNS).RidMaster)
\n$RIDInfo = $RIDManagerProperty.RIDAvailablePool
\n[int32]$TotalSIDS = $RIDInfo \/ ([math]::Pow(2,32))
\n[int64]$Temp64val = $TotalSIDS * ([math]::Pow(2,32))
\n[int32]$CurrentRIDPoolCount = $RIDInfo \u2013 $Temp64val
\n$RIDsRemaining = $TotalSIDS \u2013 $CurrentRIDPoolCount<\/p>\n

$RIDsIssuedPcntOfTotal = ( $CurrentRIDPoolCount \/ $TotalSIDS )
\n$RIDsIssuedPercentofTotal = \u201c{0:P2}\u201d -f $RIDsIssuedPcntOfTotal
\n$RIDsRemainingPcntOfTotal = ( $RIDsRemaining \/ $TotalSIDS )
\n$RIDsRemainingPercentofTotal = \u201c{0:P2}\u201d -f $RIDsRemainingPcntOfTotal<\/p>\n

Write-Output \u201cRIDs Issued: $CurrentRIDPoolCount ($RIDsIssuedPercentofTotal of total) `r \u201c
\nWrite-Output \u201cRIDs Remaining: $RIDsRemaining ($RIDsRemainingPercentofTotal of total) `r \u201c<\/p><\/blockquote>\n

Windows Server 2012 provides the capability to expand the RID pool to 2 billion RIDs by reclaiming the 31st bit (through SidCompatibilityVersion). Of course, this is a last resort scenario since a domain of all 2012 DCs is highly recommended (though 2003 and newer have a hotfix for supporting this \u201cfeature\u201d).<\/p>\n

Windows 2012 provides several RID protection mechanisms:<\/p>\n