Article ID: 289154
Article Last Modified on 1/31/2007
APPLIES TO
- Microsoft Windows 2000 Service Pack 1
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Service Pack 1
This article was previously published under Q289154
SYMPTOMS
When you back up and then restore the Directory Service on a domain controller, duplicate Security ID (SID) events may appear in Event Viewer.
CAUSE
This behavior can occur when duplicate relative IDs (RIDs) are created in the domain controller. After a domain controller is restored, it should invalidate its current relative ID (RID) pool and request a new one. The Rid AvailablePool attribute is not being reset to zero (0) correctly. Therefore, when the restored domain controller asks for a new RID pool from the RID Flexible Single Master Operation (FSMO) owner, it receives the next RID pool available based on the backup time value, which can cause the restored domain controller to begin issuing duplicate SIDs.
RESOLUTION
To prevent the scenario discussed in the article (duplicate sides following restore), intall the latest service pack for Windows 2000 prior to performing system state restores on Windows 2000 domain controllers.
STATUS
Microsoft has confirmed that this is a problem in Microsoft Windows 2000.
This problem was first corrected in Windows 2000 Service Pack 2.
Keywords: kbbug kbfix kbdisasterrec KB289154
