The samba-tool domain backup code requires that the source domain controller already have a ridNextRid attribute, which is currently only populated for one the first user is created on that DC. The algorithm for creating the ridNextRid is known, and the dbcheck code (python/samba/dbchecker.py) already has that code. If this was shared, a 'virtual' ridNextRid could be calculated, removing this restriction.