FSMO Roles in Active Directory – Windows Server 2012

We always want to know about FSMO Roles in Active Directory and it’s a common question in the Interview – So you must know About the Operational Master Roles of Windows Server 2012. What you have in your mind? Throw Out the Question the Comment Section below – Okay? What is FSMO Roles in Active Directory? I assume that You Know about Active Directory if not then you can refer the below short…

So, why shouldn’t an Infrastructure Master be ever placed on a GC?

Well, the reason is not as straightforward as it seems. Furthermore, in some cases it’s actually OK to place in on a GC. To put it simply the Infrastructure Master, updates references of objects from other domains within it’s own domain (aka phantom objects).

If you have two domains in your forest, the Infrastructure Master for domain A, will update references to objects (e.g. users) from domain B within domain A.

Errrm...yeah, so lets say a Domain Local group from domain A has a member from domain B...The Infra Master will update this reference. How does it do so?

it uses the Global Catalog, that already has a reference of all the objects found in the forest...the problem is that if you place the Infra master on a DC that is also a GC, the infra Master will never notice that the reference to objects from other domains have became stale...because the GC has fresh updates...

There are a couple of exceptions to this rule:

1. All the DCs of the domain are GCs

FSMO or Flexible Single Master Operations is a specialized domain controller set of tasks. Specialized tasks can be spread to several servers, but only one server can act as FSMO at a specific time. Transfer FSMO roles with ntdsutil.exe FSMO roles in the Active Directories can be transferred by...

Read the full Article http://activedirectoryfaq.com/2014/01/transferring-fsmo-roles/

http://www.petri.co.il/determining_fsmo_role_holders.htm

Hello,

In a very short manner I will list the FSMO roles and their purpose.

If you are a Windows system administrator you should memorize this info, it will come in handy in the future.

The FSMO Roles

Within Active Directory not all Domain Controllers are equal, some have certain roles assigned to them, these roles need to be performed by a single Domain Controller.

These roles are called the FSMO roles (Flexible Single Master Operations).

There are 5 roles, 2 of which are forest wide and the other 3 are domain wide roles.

Schema master (forest wide):

The Schema Master controls all updates to the Schema within the forest.

Domain Naming Master (forest wide):

The Domain Naming Master role is responsible for the creation and deletion of domains in the forest

PDC Emulator (domain wide):

The PDC emulator role provides backwards compatibility for Windows NT backup domain controllers (BDCs), the PDC emulator advertises itself as the primary domain controller for the domain.

It also acts as the domain master browser and maintains the latest password for all users within the domain.

Infrastructure Master (domain wide):

The Infrastructure Manager role is responsible for updating references from objects within its domain with objects in other domains.

Relative ID (RID) Master (domain wide):

The RID Master manages the Security Identifier (SID) for every object within the domain.

Hopefully this will help some of you. :)

As always, your comments/thoughts/remarks are welcome.

Until next time, Capre Diem…

Bye,

Asher

La transferencia de los roles de Mastros de Operaciones, conocidos como FSMO (Flexible Single Master Operations) podemos hacerlo tanto de forma gráfica como en línea de comandos.  Los roles FSMO a transferir son 5:

A nivel de Forest

Schema Master

Naming Master (Domain Naming Master)

A nivel de Dominio

Insfrastructure Master

RID Master

PDC (PDC Emulator)

En este caso haremos uso del comando ntdsutil para hacer la transferencia del servidor DC01 al DC02.

Para ello:

Abrimos una línea de comandos y escribimos "ntdsutil"

Luego escribimos "roles"

Ahora escribimos "connections"

Luego "connect to server DC02 (en su caso el server destino)

Digite quit (en su defecto q) y luego enter

Ahora comenzamos a transferir los roles:

Escriba "transfer schema master"

Aparecerá un mensaje de confirmación de la transferencia del rol (este mensaje aparecerá para cada uno de los roles a transferir)

Ahora digite "transfer naming master"

Luego "Transfer RID master"

Ahora "transfer PDC"

y finalizamos con "transfer infrastructure master"

Para salir de ntdsutil solo digite "quit" hasta salir al prompt del sistema.

Puede consultar ahora la ubicacion de los roles con "netdom query fsmo"