A variable-length number assigned to objects at creation, the Relative Identifier (RID) becomes part of the object's Security Identifier (SID) that uniquely identifies an account or group within a domain. The RID Master allocates security RIDs to Domain Controllers to assign to new Active Directory security principals (users, groups, or computer objects). It also manages objects moving between domains. The RID Master is one role of the Flexible Single Master Operation (FSMO) for assigning RIDs.
How the RID Fits Into a SID
The final portion of a Windows Security Identifier (SID) that uniquely distinguishes a security principal within its issuing domain or local machine. While the leading part of a SID identifies the domain or computer that created the account, the RID is the part that sets one principal apart from all other principals from the same source. Consider a SID like S-1-5-21-3623811015-3361044348-30300820-1013. Everything up to the last segment identifies the domain or local computer, and that shared prefix is common to every account issued by that authority. The trailing value, 1013 in this example, is the RID. Because all principals in a given domain share the same prefix and differ only in their RID, the RID effectively serves as the account's serial number within its domain. Combining the domain identifier with a unique RID guarantees that the full SID is unique not just locally but across the wider environment.
How RIDs Are Assigned
When a new user or group is created, the domain assigns it the next available RID from a pool of values it manages. RIDs are handed out sequentially and never reused within a domain, preserving the uniqueness that access control depends on. In an Active Directory environment, one domain controller holds the RID Master role (a Flexible Single Master Operation, or FSMO, role) and is responsible for allocating blocks of RIDs to the other domain controllers. Each controller draws from its assigned block as it creates accounts, and requests a fresh block when it runs low. This coordination prevents two controllers from ever issuing the same RID.
Well-Known RIDs
Certain RID values are reserved and have the same meaning across all Windows systems. The built-in Administrator account always has a RID of 500, and the built-in Guest account uses 501. Standard groups have their own reserved RIDs as well, for instance, Domain Admins is 512. Because these values are predictable, they're a common focus in security: locating the account with RID 500, for example, identifies the true administrator even if the account has been renamed. Regular, non-reserved accounts are assigned RIDs starting at 1000 and above.
Why RIDs Matter
The RID is what makes each SID unique, so it sits at the heart of reliable access control. Its non-reuse ensures that a deleted account's identity can't be inadvertently inherited by a new account, keeping permissions accurate over time. RIDs also matter operationally: exhausting a domain's RID pool prevents new accounts from being created, and problems with the RID Master role can disrupt account provisioning across the domain. For administrators, recognizing well-known RIDs is a practical skill when auditing accounts, reading security logs, and identifying privileged identities regardless of how they've been named.