Active Directory: Transfer of FSMO (Flexible Single Master Operations) roles
10 December 2020Overview of FSMO roles
“ Flexible Single Master Operation ”.
There are 5 Flexible Single Master Operation roles, two roles are unique in the forest and the other three are unique in a domain.
A domain controller can have zero or more FSMO roles.
To view FSMO roles, the following command must be run on a Domain Controller.
netdom query fsmo
Master of Domain Name Assignment
The operation master is unique within the forest, and it is the only one authorized to distribute domain names to domain controllers, when creating a new domain.
Schema Controller
The schema designates the structure of the Active Directory, It is unique in the forest, it manages the Active Directory schema which contains all the objects that can be created and the attributes. Only he can modify the scheme.
RID Master
It distributes an RID pool to each domain controller to ensure that each SID issued by a DC will be unique
Primary domain controller (PDC) emulator
It is unique within the domain, it is responsible for synchronizing the time between the different servers and computers and modifying passwords as well as locking accounts.
Master infrastructure
It is unique within the domain, its role is to manage inter-domain references.
You can transfer a single role or several, you can transfer FSMO roles using the command line utility Ntdsutil.exe, PowerShell or using the graphical wizard
To transfer the FSMO role, the administrator must be a member of the following group:
NTDSUTIL.exe
To do this, simply go to Start, Execute then type “ ntdsutil.exe “.
- Type ” roles ” and press Enter.
- Type ” connections ” and press Enter.
- Type ” connect to server ‘server name’ ” and press Enter. “The server name must match the server that receives the roles
- Type ” quit ” and press Enter.
We will transfer the FSMO roles one by one with the corresponding command as appropriate. After each entry appears a confirmation window. Just click Yes to continue.
- For Schema Master tape ” transfer schema master ” and press Enter.
- For RID Master tape ” transfer rid master ” and press Enter.
- For Domain Naming Master tape ” transfer naming master ” and press Enter.
- For PDC Emulator tape ” transfer pdc ” and press Enter.
- For Infrastructure Master tape ” transfer infrastructure master ” and press Enter.
Once the role transfer is complete, type ” quit ” to quit NTDSUTIL
PowerShell
To do this, simply open a PowerShell console as an administrator.
1 2 |
Import-Module ActiveDirectory » Move-ADDirectoryServerOperationMasterRole -Identity “S2” –OperationMasterRole DomainNamingMaster,PDCEmulator,RIDMaster,SchemaMaster,InfrastructureMaster |
Graphic assistant
- Go to Active Directory Users and Computers
- In Action => Operation master, there is a tab for each FSMO master that can be transferred. (RID, CDP for PDC emulator and Infrastructure)
- Finally, it remains to migrate the schema master. To do this, you have to open a command prompt and register the necessary DLL:
1 |
regsvr32.exe schmmgmt.dll |
- Now open a new MMC console
- Then go to File => Add / Remove snap-in,
- Choose Active Directory Schema.
- In Active => Operation master, you will find the interface to migrate the role: schema master.
Migration verification
To check that the roles have been migrated, we use the command seen previously
netdom query fsmo
Views: 2090