The error: "The directory service was unable to allocate a relative identifier." means your domain controller cannot assign a new RID (Relative Identifier), which is essential for creating any new AD object like users, groups, or computers.

Hello Mohammed Ahmed,

The demotion and re-promotion process successfully restored your Cloud Domain Controller's functionality? Since your previous attempts with ntdsutil and registry edits failed to clear the "corrupt data" error, it confirmed that the local Active Directory database (ntds.dit) on that specific server was irreparably damaged and could not be salvaged by standard repair tools.

To recap the solution, because the corruption was local to the Cloud DC, the only reliable fix is to transfer the FSMO roles to your healthy On-Premises server to safeguard them, and then fully demote the Cloud Server 2022. This process deletes the corrupted database file. Upon re-promoting the server, it forces a download of a completely fresh, error-free copy of the directory and RID pool from the On-Premises source, which solves the issue where soft resets failed.

If the issue has been successfully resolved, please consider accepting the answer as it helps other people sharing the same question benefit too. Thank you!

VP

Hi there,

I am writing to follow up and see if the ntdsutil cleanup procedure allowed your Cloud DC to successfully allocate a fresh RID pool and resume object creation. As we discussed, since your previous attempts to transfer FSMO roles and increase the pool size failed to resolve the rIDAvailablePool error, it confirmed that the corruption was embedded in the RID Manager's internal allocation table itself. In this state, standard replication just propagates the error, which is why the surgical invalidation of the pool was the required fix.

If the instructions to purge the corrupted pool via ntdsutil helped you get your cloud environment functional again without requiring a full server demotion, please consider accepting the answer. This confirmation is vital for other administrators who might encounter this specific "corrupt data" error after a cloud migration and might otherwise waste time trying to troubleshoot network connectivity instead of database integrity.

VP

Hello Mohammed Ahmed,

The fact that transferring FSMO roles and increasing the RID pool couldn't resolve the error confirms that the core database metadata for the RID management pool on the cloud DC is structurally corrupted. This is not a capacity issue but a corruption of the internal allocation tables within the NTDS.dit. Standard role transfers and replication will not fix this; the corrupted data is simply replicated.

You must perform an authoritative reset of the RID pool using the Ntdsutil tool, which is more surgical than registry edits. This process will create a new, valid RID pool while preserving the rest of your Active Directory data. Follow these steps on the cloud DC (the current RID master):

Open an elevated Command Prompt.

Stop the Active Directory Domain Services service:

net stop ntds

Launch Ntdsutil:

ntdsutil

At the ntdsutil: prompt, activate the instance:

activate instance ntds

Enter the RID management context:

rid

Execute the cleanup command. This will purge the current, corrupted RID pool:

cleanup

Exit Ntdsutil by typing quit twice.

Restart the AD DS service:

net start ntds

Upon restart, the DC, acting as the RID master, will generate a completely new RID pool for itself. Immediately verify by running dcdiag /test:ridmanager /v and checking for Event ID 16650 in the Directory Service log, which confirms successful pool allocation.

Critical Precaution: Before this operation, ensure the on-prem DC is online and replicating. After the reset, force replication from the cloud DC to the on-prem DC using repadmin /syncall /A /e. This ensures the new RID pool metadata is propagated and prevents the on-prem DC from attempting to use any stale RID references.

If this procedure fails, the last resort is to seize the RID master role back to the on-prem 2012 DC, then perform the ntdsutil rid cleanup on the cloud DC while it holds a non-RID master role, and finally transfer the role back cleanly. This isolates the corruption to a member DC during repair.

Hi Mohammed Ahmed,

The error The DS has corrupt data: rIDAvailablePool value is not valid indicates that the cloud domain controller (the current RID master) has a corrupted RID pool in its database. This is likely due to replication conflicts or an improper FSMO role seizure during the transition.

First, verify the RID master role is indeed on the cloud DC and that it can contact itself. Run:

text

netdom query fsmo

Ensure the RID Pool Manager role lists the cloud DC. Then, check replication from the cloud DC's perspective using:

text

repadmin /replsummary

Look for failures, especially regarding the Schema or Domain partitions. If replication is failing, you must resolve that first.

To repair the RID pool, begin with an authoritative restore of the RID pool on the cloud DC. Open an elevated Command Prompt and execute:

text

dcdiag /fix

This will attempt to auto-correct inconsistencies. If that fails, you can manually reset the RID pool via the registry, but this is a sensitive operation. On the cloud DC, open regedit and navigate to HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters. Backup the key, then delete the values RID Available Pool and RID Next RID. Restart the NTDS service or reboot the server. Upon restart, the DC will request a new RID pool from itself as the RID master, effectively resetting the pool.

Before taking this step, ensure the on-prem DC is online and replicating correctly to avoid SID duplication. After resetting, monitor Event ID 16650 (successful RID pool allocation) and test creating a new user object. Run dcdiag /test:ridmanager /v again to confirm the error is resolved.

Do not demote and re-promote the cloud DC unless absolutely necessary, as this will cause significant disruption. If the manual registry fix doesn't work, consider seizing the RID master role back to the on-prem DC temporarily, then transferring it cleanly back to the cloud DC after ensuring replication is healthy.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to ACCEPT ANSWER then. Should you have more questions, feel free to leave a message. Have a nice day!

VPHAN