Fix ERROR_DS_NO_RIDS_ALLOCATED (0x00002010) in Active Directory

Quick Answer

Run dcdiag /test:rid to confirm, then use ntdsutil to force a new RID pool allocation on the RID master. If that fails, seize the RID master role.

What's Happening Here

Every domain controller requests blocks of 500 RIDs (relative identifiers) from the RID master. When you hit 0x00002010, your DC has exhausted its current RID pool and can't get a new one from the RID master. This happens most often after a DC restore from backup, a failed role transfer, or if the RID master itself is misconfigured. The error shows up during user/group creation, AD object creation, or any operation that needs a new security identifier (SID).

Step-by-Step Fix

1. Identify the problem DC – Run dcdiag /test:rid on the DC showing the error. Look for 'RID Allocation Failed' or 'Unable to allocate a RID pool' in the output. Note the DC name.
2. Check RID master – Verify the RID master FSMO role holder: netdom query fsmo. That machine must be online and reachable. If it isn't, you'll need to seize the role (step 6).
3. Force a new RID pool on the affected DC – On the DC with the error, open elevated Command Prompt and run:

   ntdsutil
   'activate instance ntds'
   'rid pool'
   'allocate pool'
   'q'
   'q'

   This forces a new pool request from the RID master. Wait 2 minutes, then run dcdiag /test:rid again.
4. Verify pool allocation – Use repadmin /showrepl to check replication status. The RID pool change replicates automatically, but if replication's broken, fix that first.
5. If step 3 fails – The RID master might be stuck. Run dcdiag /test:rid on the RID master itself. If it shows errors, move to alternative fixes.
6. Seize RID master role – Only do this if the RID master is dead or unreachable. On a functioning DC, run:

   ntdsutil
   roles
   connections
   connect to server <new_RID_master>
   quit
   seize rid master
   quit
   quit

   After seizing, repeat step 3 on the original problem DC.

Alternative Fixes

• If you're still stuck – Check the RID master's event log (Event ID 16650-16654). Those events tell you exactly why pool allocation failed. Common causes: the RID master's own pool is exhausted (rare) or the AD database is corrupt.
• Run a clean AD restore – If the problem started after a backup restore, you may have restored a DC with a stale RID pool. Do a non-authoritative restore of the entire domain controller, then force pool allocation again.
• Clear the RID pool manually – Advanced only: delete the RID registry key on the problem DC (HKLM\SYSTEM\CurrentControlSet\Services\NTDS\RID), restart the NTDS service. This forces a fresh pool request. But it's risky — only do this if you understand the implications.

Prevention

Set up alerts on Event ID 16656 (RID pool usage over 80%). That gives you time to allocate more pools before exhaustion hits. Also, never restore a DC from backup without transferring the RID master role first. If you absolutely must restore, demote and re-promote the DC instead of doing a bare-metal restore.

Real-world trigger: A helpdesk guy restored a DC from a 3-month-old backup to fix a separate issue. Two days later, no one could create user accounts. 0x00002010 everywhere. Forcing a new RID pool fixed it in 5 minutes.