Two roles exist per domain: the RID Master hands out blocks of Relative IDs to other DCs so they can create new security identifiers without collision, and the PDC Emulator handles password changes ...