# Invalidate a domain controller's RID pool and verify the renewal behavior > Use AD Forest Recovery - Invalidating the RID Pool to review this narrow operational decision without extending the source beyond its stated scope. - Canonical URL: https://update.dsesecurity.com/updates/invalidate-domain-controller-rid-pool-verify-renewal/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-08-27T12:14:25+00:00 - Modified: 2026-08-27T12:58:58+00:00 - Last reviewed by DSE: 2026-08-26 - Resource type: Briefing - DSE priority: Advisory - Topics: Business Continuity, IT, Microsoft 365 & Identity - Reading time: 3 minutes ## What you need to know Use AD Forest Recovery - Invalidating the RID Pool to review this narrow operational decision without extending the source beyond its stated scope. ## Potentially affected Teams, systems, services, or facilities within the stated scope of AD Forest Recovery - Invalidating the RID Pool ## DSE recommendation Compare the observed state with the cited official source, document applicability and exceptions, and test any approved change with rollback safeguards. ## Article Use this document to resolve one bounded operational decision: Invalidate a domain controller’s RID pool and verify the renewal behavior. Only the official source and traced locations below supply facts. Confirm applicability before acting. ## Source fact: The official [AD Forest Recovery – Invalidating the RID Pool](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-invaildate-rid-pool) from Microsoft supports the following bounded statements: - Microsoft provides a PowerShell procedure that invalidates the current RID pool on one domain controller. The research record locates this support at Invalidate the current RID pool > PowerShell procedure. - Directory-Services-SAM event 16654 in the System log verifies completion on Windows Server 2012; Microsoft notes that earlier Windows versions do not log this event. The research record locates this support at Invalidate the current RID pool > verification paragraph. - After invalidation, the first security-principal creation attempt fails and requests a new RID pool; retrying succeeds after the new pool is allocated. The research record locates this support at Invalidate the current RID pool > Note. Do not import neighboring assumptions into the source record. The supported task is a scoped comparison involving forest recovery plans, trusted backups, isolated recovery networks, controller rebuild order, credential resets, and validation steps and the conditions the source actually describes. ## What the source does not establish The page is a forest-recovery procedure and does not establish that every restored controller requires this action; apply it only to the controller selected by the recovery plan. Do not read the source as proof of implementation or permission to change production. Its guidance remains conditional on offline credentials, Windows DNS, time, virtualization, storage, PKI, network isolation, and authorized recovery personnel and the environment’s recorded constraints. ## Applicability questions - For source statement 1 at Invalidate the current RID pool > PowerShell procedure, which observable configuration, record, or test can confirm applicability here? - For source statement 2 at Invalidate the current RID pool > verification paragraph, which observable configuration, record, or test can confirm applicability here? - For source statement 3 at Invalidate the current RID pool > Note, which observable configuration, record, or test can confirm applicability here? - What inventory proves which parts of forest recovery plans, trusted backups, isolated recovery networks, controller rebuild order, credential resets, and validation steps are in and out of scope? - Which condition in offline credentials, Windows DNS, time, virtualization, storage, PKI, network isolation, and authorized recovery personnel must be healthy before evidence is trustworthy? - What result would disprove the working assumption and return the issue to the owner? ## DSE recommendation: DSE recommends using the cited source as the evidence anchor for this decision. Use a two-person review for the source interpretation and the resulting operational decision. Record the source location, examined part of forest recovery plans, trusted backups, isolated recovery networks, controller rebuild order, credential resets, and validation steps, observed and expected states, owner, and reason for deviation. An implementation decision needs an owner, approved window, prechecks, observable outcome, stop authority, and rollback path. Validate offline credentials, Windows DNS, time, virtualization, storage, PKI, network isolation, and authorized recovery personnel before and after the test, and store only sanitized operational evidence. ## Verification and evidence Evidence should let another reviewer reproduce this decision. Retain observations beside the traced locations Invalidate the current RID pool > PowerShell procedure; Invalidate the current RID pool > verification paragraph; Invalidate the current RID pool > Note. Favor backup manifests, restore logs, isolation proof, recovery timing, role-transfer records, DNS validation, and exercise findings, linked to stable identifiers, time, and operator. Close the review only when the evidence, exception handling, resulting action, and after-state are linked. Schedule a new review after material technical, organizational, incident, or source changes; today’s observation is not a continuing guarantee. ## Official references - [AD Forest Recovery – Invalidating the RID Pool](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-invaildate-rid-pool) — Microsoft ## Primary reference - Name: AD Forest Recovery - Invalidating the RID Pool - Authority: Microsoft Learn - URL: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/forest-recovery-guide/ad-forest-recovery-invaildate-rid-pool - Source publication date: 2025-05-12 ## Citation and use Preferred citation: “Invalidate a domain controller's RID pool and verify the renewal behavior,” DSE Security, https://update.dsesecurity.com/updates/invalidate-domain-controller-rid-pool-verify-renewal/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.