Network Services - Determining 5 Flexible Single Master Operations (FSMO) Roles for Active Directory Domain Controller

Determining 5 Flexible Single Master Operations (FSMO) Roles for Active Directory Domain Controller

Most domain controller functions replicate among the domain controllers in an Active Directory domain. There are five functions, though, that are not replicated. What this means is if you lose the domain controller that has the FSMO roles, then you need to do some recovery steps before your domain controllers replicate properly again. To determine what FSMO role a server has, use the ntdsutil command:

C:\Documents and Settings\Administrator>ntdsutil
ntdsutil: ?
?                             - Show this help information
Authoritative restore         - Authoritatively restore the DIT database
Configurable Settings         - Manage configurable settings
Domain management             - Prepare for new domain creation
Files                         - Manage NTDS database files
Help                          - Show this help information
LDAP policies                 - Manage LDAP protocol policies
Metadata cleanup              - Clean up objects of decommissioned servers
Popups %s                     - (en/dis)able popups with "on" or "off"
Quit                          - Quit the utility
Roles                         - Manage NTDS role owner tokens
Security account management   - Manage Security Account Database - Duplicate SI
D Cleanup
Semantic database analysis    - Semantic Checker
Set DSRM Password             - Reset directory service restore mode administra
tor account password
ntdsutil: roles
fsmo maintenance: ?
?                             - Show this help information
Connections                   - Connect to a specific domain controller
Help                          - Show this help information
Quit                          - Return to the prior menu
Seize domain naming master    - Overwrite domain role on connected server
Seize infrastructure master   - Overwrite infrastructure role on connected serv
er
Seize PDC                     - Overwrite PDC role on connected server
Seize RID master              - Overwrite RID role on connected server
Seize schema master           - Overwrite schema role on connected server
Select operation target       - Select sites, servers, domains, roles and
naming contexts
Transfer domain naming master - Make connected server the domain naming master
Transfer infrastructure master - Make connected server the infrastructure maste
r
Transfer PDC                  - Make connected server the PDC
Transfer RID master           - Make connected server the RID master
Transfer schema master        - Make connected server the schema master
fsmo maintenance: connections
server connections: ?
?                             - Show this help information
Clear creds                   - Clear prior connection credentials
Connect to domain %s          - Connect to DNS domain name
Connect to server %s          - Connect to server, DNS name or IP address
Help                          - Show this help information
Info                          - Show connection information
Quit                          - Return to the prior menu
Set creds %s %s %s            - Set connection creds as domain, user, pwd.
Use "NULL" for null password,
* to enter password from the console.
server connections: connect to server remote1
Binding to remote1 ...
Connected to remote1 using credentials of locally logged on user.
server connections: q
fsmo maintenance: select operation target
select operation target: ?
?                             - Show this help information
Connections                   - Connect to a specific domain controller
Help                          - Show this help information
List current selections       - List the current site/domain/server/Naming Cont
ext
List domains                  - Lists all domains which have Cross-Refs
List domains in site          - Lists domains in the selected site
List Naming Contexts          - Lists known Naming Contexts
List roles for connected server - Lists roles connected server knows about
List servers for domain in site - Lists servers for selected domain and site
List servers in site          - Lists servers in selected site
List sites                    - List sites in the enterprise
Quit                          - Return to the prior menu
Select domain %d              - Make domain %d the selected domain
Select Naming Context %d      - Make Naming Context %d the selected Naming Cont
ext
Select server %d              - Make server %d the selected server
Select site %d                - Make site %d the selected site
select operation target: list roles for connected server
Server "remote1" knows about 5 roles
Schema - CN=NTDS Settings,CN=SV-1-WIN2003,CN=Servers,CN=Default-First-Site-Name,
CN=Sites,CN=Configuration,DC=remote1,DC=networking7by24,DC=com
Domain - CN=NTDS Settings,CN=SV-1-WIN2003,CN=Servers,CN=Default-First-Site-Name,
CN=Sites,CN=Configuration,DC=remote1,DC=networking7by24,DC=com
PDC - CN=NTDS Settings,CN=SV-1-WIN2003,CN=Servers,CN=Default-First-Site-Name,CN=
Sites,CN=Configuration,DC=remote1,DC=networking7by24,DC=com
RID - CN=NTDS Settings,CN=SV-1-WIN2003,CN=Servers,CN=Default-First-Site-Name,CN=
Sites,CN=Configuration,DC=remote1,DC=networking7by24,DC=com
Infrastructure - CN=NTDS Settings,CN=SV-1-WIN2003,CN=Servers,CN=Default-First-Si
te-Name,CN=Sites,CN=Configuration,DC=remote1,DC=networking7by24,DC=com
select operation target: q
fsmo maintenance: q
ntdsutil: q
Disconnecting from remote1...
C:\Documents and Settings\Administrator>

The first domain controller in the forest root domain is assigned all 5 FSMO roles. So, that is a good place to start. There are a number of ways that this can change, though, so it is good to make sure.

This article comes from NetAdminTools:
http://www.netadmintools.com/

The URL for this story is:
http://www.netadmintools.com/art566.html

Copyright 1997-2008 NetAdminTools.com. Read our Terms of Use.