Managing RID Pool Depletion

re: Managing RID Pool Depletion

NedPyle [MSFT] — Wed, 07 Dec 2011 15:44:36 GMT

Not this one, no. It's just a bug fix for Null RID set references to prevent accidentally gobbling up RIDs unnecessarily.

DCDIAG will tell you if you have the issue though, so periodically checking with that would give you the info you need. It will show:

Starting test: RidManager

Warning: attribute rIdSetReferences missing from

CN=name,OU=Domain Controllers,DC=name,DC=name,DC=name,DC=name

Could not get Rid set Reference :failed with 8481:

The search failed to retrieve attributes from the database.

If you are running DCDIAG every so often to track RID consumption, you'd know of the issue.

re: Managing RID Pool Depletion

ckuderna — Wed, 07 Dec 2011 15:19:43 GMT

Just one question regarding the hotfix 2618669: does it produce any kind of warning or an event to monitor? Or does it just fix a known issue but not prevent anyone from wasting RIDs through some stupid action?

Thanks

Chris

re: Managing RID Pool Depletion

NedPyle [MSFT] — Mon, 05 Dec 2011 19:09:14 GMT

We need customers to open a support case and ask for it. So far, only R2 customers have asked.

So the real question is "why haven't YOU made us make one yet, Brian?"

re: Managing RID Pool Depletion

BrianYx2 — Mon, 05 Dec 2011 18:56:26 GMT

Why is the hot fix only for 2008 R2? Why not 2008 as well? It would be great to have the 2^31 option available on both OSs.

re: Managing RID Pool Depletion

NedPyle [MSFT] — Mon, 10 Oct 2011 16:40:18 GMT

I'd love to talk about future plans, but cannot. Rest assured that they exist.

re: Managing RID Pool Depletion

mrobinsn — Mon, 10 Oct 2011 14:42:59 GMT

Why not put in a "fix" in a service pack or something which stops issuing when there is x% left, ie by default 10%. Then if a customer DOES get into that situation, they are offline only temporarily, they can identify the problem, stop whatever is automatically generating new ids, lower the block to 5% or something, and then have time to migrate to a new domain structure?

If an exchange disk runs out of space, the store dismounts, but once you do something to alleviate the issue, you can be up and running again. Say its on a SAN, add 50 GB of space and it'll give you a month to figure out where to relocate the storage, break up the database mailboxes, etc.

re: Managing RID Pool Depletion

NedPyle [MSFT] — Sat, 17 Sep 2011 15:55:52 GMT

500 per DC by default is not so bad. Let's say you were issuing 500 RIDs each day on each DC, and you had a 100 DCs. That is 50,000 new users/groups/computers you created every day, or 18,250,000 security principals a year. Which would make you by far the largest AD domain in the world.

You still would not run out for 58 years. :)

The main idea is not to protect the network from traffic - as you're right, the actual data sent is miniscule - but instead to allow a DC some autonomy when there is no network. If you are a Marine comm platoon in Afghanistan with a domain controller in your firebase, it may not be able to talk to other DCs in the domain for a few weeks at a time. So to create new groups or add laptops to the domain in that location, you'll need a RID pool that works offline for awhile.

re: Managing RID Pool Depletion

Momaweb — Sat, 17 Sep 2011 06:16:19 GMT

That's curious. in the past I had the chance to change the 500-block of assigned RIDs via registry key, because of a problem on my customer... so, you can actually choose how many RIDs are assigned to each DC. Now that I read this article, since assigning 500 rids block could be risk after ten years of AD working in large enterprises, I don't understand why the assigned pool is still made of 500 RIDs. Why did MSFT not change to 50 RIDs for example? I am pretty sure that there would not be performance or network traffic issues, reducing the pool size of one tenth could actually make the difference in terms of waste (I just think about how many DCs I decomissioned on enterprises).

re: Managing RID Pool Depletion

NedPyle [MSFT] — Wed, 14 Sep 2011 13:47:19 GMT

You suffered blog pool depletion. Maybe System Center 2012 has a monitor for that?

re: Managing RID Pool Depletion

Mark Morowczynski [MSFT] — Tue, 13 Sep 2011 23:59:36 GMT

I was talking to a customer last week about this on an ADRAP and thought....hmm I should write a post about that later. Then you destroyed me. Though I was going to name it "RID Pool Depletion, The Silent Domain Killer...Wait What?" Back to XPerf for me.