Mike Brawley Exploring the World!

Determining and transfer FSMO roles to a new Domain Controller

The following list describes the 5 unique FSMO roles in an Active Directory forest and the dependent operations that they perform:

• Schema master - The Schema master role is forest-wide and there is one for each forest. This role is required to extend the schema of an Active Directory forest or to run the adprep /domainprep command.
• Domain naming master - The Domain naming master role is forest-wide and there is one for each forest. This role is required to add or remove domains or application partitions to or from a forest.
• RID master - The RID master role is domain-wide and there is one for each domain. This role is required to allocate the RID pool so that new or existing domain controllers can create user accounts, computer accounts or security groups.
• PDC emulator - The PDC emulator role is domain-wide and there is one for each domain. This role is required for the domain controller that sends database updates to Windows NT backup domain controllers. The domain controller that owns this role is also targeted by certain administration tools and updates to user account and computer account passwords.
• Infrastructure master - The Infrastructure master role is domain-wide and there is one for each domain. This role is required for domain controllers to run the adprep /forestprep command successfully and to update SID attributes and distinguished name attributes for objects that are referenced across domains.

Display the Current FSMO Role Holders

Before transfering your FSMO roles to a new server you may want to know what current Domain Controller holds each FSMO role.  There is a really easy way to do this from the command prompt.  You can open Active Directory Users and Computers and view the Operating Masters but this only shows you a few. The command prompt is the fastest easiest way.

1. Open Command Prompt
2. Type netdom query fsmo
   
3. The output above will give you a current list of all FSMO role holders

Transfer FSMO Role Holders

Microsoft recommends that you transfer FSMO roles in the following scenarios:

• The current role holder is operational and can be accessed on the network by the new FSMO owner.
• You are gracefully demoting a domain controller that currently owns FSMO roles that you want to assign to a specific domain controller in your Active Directory forest.
• The domain controller that currently owns FSMO roles is being taken offline for scheduled maintenance and you need specific FSMO roles to be assigned to a “live” domain controller. This may be required to perform operations that connect to the FSMO owner. This would be especially true for the PDC Emulator role but less true for the RID master role, the Domain naming master role and the Schema master roles.

To migrate from one Domain Controller to another you will need to transfer the FSMO roles after running DCPROMO on the new domain controller. The easiest way to do so is by the command prompt.

1. Open Command Prompt
2. Type ntdsutil, and then press ENTER
3. Type roles, and then press ENTER.
4. Type connections, and then press ENTER.
5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.
6. At the Server Connections prompt, type q, and then press ENTER.
7. Type transfer role, where role is the role you want to transfer. For a list of roles that you can transfer, type ? at the fsmo maintenance prompt, and then press ENTER, or see image below.
   
8. At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.

Seise FSMO Role Holders

Microsoft recommends that you seize FSMO roles in the following scenarios:

• The current role holder is experiencing an operational error that prevents an FSMO-dependent operation from completing successfully and that role cannot be transferred.
• A domain controller that owns an FSMO role is force-demoted by using the dcpromo /forceremoval command.
• The operating system on the computer that originally owned a specific role no longer exists or has been reinstalled.

The seise command is great when your current role holder is no longer on the domain.  I have seen multiple companies where the current role holder was inproperly decomisioned and still holds FSMO roles but the physical server is long gone.  This is the main reason I have had to seise FSMO roles. A domain controller whose FSMO roles have been seized should not be permitted to communicate with the existing domain controllers in the forest.  If you have to seise the FSMO roles from a domain controller either format that servers hard drive or reinstall windows to be sure that domain controller is never reintroduced to the forest.

1. Open Command Prompt
2. Type ntdsutil, and then press ENTER
3. Type roles, and then press ENTER.
4. Type connections, and then press ENTER.
5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.
6. At the Server Connections prompt, type q, and then press ENTER.
7. Type seize role, where role is the role you want to transfer. For a list of roles that you can transfer, type ? at the fsmo maintenance prompt, and then press ENTER, or see image below.
   
8. At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.