Windows cannot create the object because the Directory Service was unable to allocate a relative ide

[knc]

Windows cannot create the object because the Directory Service was unable to allocate a relative identifier.

Got this message when trying to add a new user to a recently restore VM Server, host died. So my research shows some repairs but I am too timid to perform them, my thought is to call Microsoft for a support session and let them do it. Any thoughts?

My guess is the DNS is pointing to the original Host and that is obviously gone.

 

[NETWizz]

Windows cannot create the object because the Directory Service was unable to allocate a relative identifier.

Got this message when trying to add a new user to a recently restore VM Server, host died. So my research shows some repairs but I am too timid to perform them, my thought is to call Microsoft for a support session and let them do it. Any thoughts?

My guess is the DNS is pointing to the original Host and that is obviously gone.

If your domain is in a production environment, I suggest you open a TAC case with Microsoft and to always have a backup...



You almost certainly have a problem with your operations masters formerly known as FSMO Roles.

To view the servers running these, do a "netdom query fsmo" in a command prompt window.

It will list the location of your Schema master, Domain naming master, PDC, RID pool manager, and Infrastructure master.


Your problem most likely is with the RID pool manager.



You can test it with a DCDiag

dcdiag /test:ridmanager /v


Anyway, if the role doesn't exist anywhere, you can always SEIZE the role on another Domain Controller restoring functionality.

Here is how:

https://technet.microsoft.com/en-us/library/cc816779(v=ws.10).aspx




The thing is don't just start seizing roles. If you goof things up, you will make your domain worse not better.

 

[knc]

The thing is don't just start seizing roles. If you goof things up, you will make your domain worse not better.

That is my thought exactly!

 

[TurricanII]

Word for word what @NETWizz said! RID manager is offline I need to be brought back online or seized to another domain controller.

 

[knc]

Fortunately, this client has a techsoup account and the visual studio is $57 with two support incidents.

 

[knc]

Microsoft got this resolved, we used our $74 Visual Studio Professional with MSDN 2 support instances. This is what he did. Impressive to watch them work the Powershell.

Cause: Schema master and domain naming master on crashed DC


Resolution:

1.Seized the schema master and domain naming master role to the DC:SERVER2013

2.Performed metadata cleanup for the crashed DC

3.Corrected the DNS pointing on the existing DC

4.Test user created successfully

5.Issue resolved

 

[Metanis]

Thanks so much for posting the detailed resolution.