How to transfer FSMO roles

What is FSMO?

A flexible single-master operation (FSMO) is a set of AD (Active Directory) operations or roles designed to help eliminate replication conflicts. FSMO is used when standard data transfer and update methods are inadequate in a specialized domain.

Single-master model

Updates to specific objects in the Active Directory are made in a single-master method to avoid conflicting updates in Windows. Only once DC in the entire directory is allowed to process updates in a single master model. It’s the same as the role given to the primary domain controller (PDC) in the earlier versions of windows.

The single-master model used by older versions of Windows is expanded by Active Directory to allow numerous roles, and is given the ability to transfer roles to any DC within the company.

Since the role of Active Directoy isn’t bound to any single DC, It’s referred to as a FSMO role. Currently, there are 5 FSMO roles in Windows that are classified under 2 main heads:

1. Forest wide
2. Domain wide

1. Forest wide

• Schema master
• Domain naming master

2. Domain wide

• RID master
• PDC emulator
• Infrastructure master

These roles are further explained in detail here.

An FSMO role ownership often isn’t executed until the domain controller has replicated the naming context (NC) where the ownership is held ever since the Directory Service started. Prior to the role being used, make sure the prior owner receives notice of an FSMO role seizure.

Why should FSMO roles be transferred?

The first domain controller in the forest root domain receives a default allocation of all five FSMO roles when Active Directory is first configured. Transferring FSMO roles is frequently necessary for a number of reasons, including:

• Demoting a domain controller
• Performance issues

• Changing IP addresses on a domain controller
• Taking a domain controller offline for maintenance
• Upgrading the operating system

It is advised to only transfer FSMO roles while the holder is active and reachable on the network.

Transferring FSMO roles can be done by 2 methods:

The first is using PowerShell and the second is using the ADUC GUI.

Things to remember while transferring FSMO roles

1.Transferring FSMO roles using PowerShell

• Before transferring to PowerShell, view the current FSMO role holders. To locate each of the current FSMO role holders, run, Get-ADDomain and Get-ADForest on an elevated Windows PowerShell prompt as shown below.

• Transfer FSMO roles

Once you know which DCs currently hold the FSMO roles, you can transfer those roles as well. Run the Move-ADDirectoryServerOperationMasterRole command in Windows PowerShell using the Identity parameter for the DC you want to move the FSMO role to (in this case, ChildDC1), followed by the name of the FSMO role.

The below examples is transferring the RID master role:

For the FSMO role name, you can use PDCEmulator, RIDMaster, InfrastructurerMaster, SchemaMaster and, DomainNamingMaster.

You can also transfer more than one role at once by defining each role name separated by a comma e.g. Move-ADDirectoryServerOperationMasterRole -Identity “ChildDC1” PDCEmulator,InfrastructureMaster.

Now let’s look at transferring roles using the Active Directory Users and Computers GUI.

2. FSMO Roles Transfer Using ADUC GUI

• You must log into the server where the data will be transferred, much like PowerShell.

• Right-click the domain in the Active Directory Users and Computers console, then select Operations Masters from the menu that appears.

• You should now see a screen with three tabs (RID, PDC, and Infrastructure.

• Simply select the Change button to move one of these roles. You must log into the server you want to transfer the role to because you cannot choose which domain controller you want to transfer it to. Say for example: One wants to transfer the RID to role DC5, they would do log into that server.

• You should first open Active Directory Domains and Trusts in order to transfer the domain naming operations master role. “Operations Master” can be chosen by performing a right-click on “Active Directory Domains and Trusts”.

• Now click on change to transfer the role to another DC

• Follow the below mentioned steps to transfer to schema master.

• Open a command line and run the command regsvr32 schmmgmt.dll

• The next step is to access an MMC console. In order to do this, click Start, type mmc, and then click the icon.

• Now, click File, then Add/Remove Snap-in.

• Add “Active Directory Schema” and click ok.

• To transfer the schema master role, right-click on Active Directory schema and select “Operations Master.”

As you can see, transferring FSMO roles via the GUI requires a significant number of additional steps, which is why using PowerShell is preferred. If you’re not into PowerShell, the GUI will suffice.

Active Directory FSMO roles – Best practices

• Initially when you install a new Active Directory domain, all the FSMO roles get placed on a single server. The Best Practice, according to Microsoft, is to distribute the FSMO roles throughout the various domain controllers.
• Keep in mind, the forest-wide FSMO roles should be placed in one DC and the domain-wide FSMO roles in an other DC. It is suggested that you have an additional DC in place instead of just having one. As a result, you must assign the FSMO role in an AD domain with a minimum configuration of two DCs as follows:
• DC-1

• RID Master
• Infrastructure Master
• PDC Emulator
• DC-2

• Schema Master
• Domain Master

• The availability of the FSMO roles should be constantly checked to see which DCs they are in as knowing where the roles are located helps troubleshooting any issues with domain controllers.
• Incase the original role owner encounters a failure, a standby DC should be configured to take over a FSMO role owner. The standby domain controller can take over or transfer the roles.
• The FSMO roles should be placed in such a way that other computers can access them as well.
• The roles should not frequently be transferred as it is imperative to force domain clients to rediscover the PDC often.
• Disable time synchronization of virtual machines with FSMO roles with the host if you’re utilizing virtualized domain controllers.
• Do not assign the domain controllers any more tasks.

Summary

Moving FSMO roles to another server is not a common task, but it is considered necessary whenever needed. When switching roles, Microsoft recommends that the server be online. The steps in this tutorial should come in handy when the time comes to switch roles.