Error Message: The Account-Identifier Allocator Failed to Initialize Properly (248410)


The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
This article was previously published under Q248410

SYMPTOMS

You may receive the following event approximately every two minutes in the NTDS event log:
Event 16650

MessageId=0x410A

SymbolicName=SAMMSG_RID_INIT_FAILURE

Language=English

The account-identifier allocator failed to initialize properly. The record data contains the NT error code that caused the failure. Windows 2000 may retry the initialization until it succeeds; until that time, account creation will be denied on this Domain Controller. Please look for other SAM event logs that may indicate the exact reason for the failure.

CAUSE

This behavior can occur because the RID Master FSMO is unavailable or fails to replicate. The Domain Controller cannot obtain and initialize the RID pool.

This behavior can also occur when the User Right "Access this computer from the network" has not been given to the appropriate groups such as "Enterprise Domain Controllers" or "Authenticated Users".

RESOLUTION

To troubleshoot this behavior, examine the NTDS event log for further detail about the replication failure.

Determine the RID Master FSMO by following the steps in the following Microsoft Knowledge Base article:

234790 How to Find FSMO Role Holders (Servers).

Verify network connectivity by using the ping command. For additional information about how to use the PING command, click the article numbers below to view the articles in the Microsoft Knowledge Base:

169790 How to Troubleshoot Basic TCP/IP Problems in Windows NT 4.0

200525 Using NSlookup.exe



If the RID Master is down for an extended period of time, follow the steps in the following Microsoft Knowledge Base article:

223787 Flexible Single Master Operation Transfer and Seizure Process

.

To add either the "Enterprise Domain Controllers" or "Authenticated Users" group to the right "access this computer from the network", perform the following steps in Domain Controller Security Policy:

Open this policy by clicking Start, then programs, then Administrative Tools, and then Domain Controller Security Policy.Expand the Security Settings to Local Policies, and then to User Rights Assignment.Double click the right "access this computer from the network" and Add either the Everyone or Authenticated Users to this right.

If there are multiple Win2k Domain Controllers, then from a command prompt also run the following command to refresh this change on their policies as well. Run the command without "" marks.

"secedit /refreshpolicy machine_policy /enforce"

Modification Type:MajorLast Reviewed:2/24/2004
Keywords:kbenv kberrmsg kbnetwork kbprb KB248410
©2004 Microsoft Corporation. All rights reserved.