In Active Directory, all domain controllers are nearly equal. Each one can accept changes and replicate them to the others. But a few tasks would cause conflicts if two servers performed them at the same time, such as changing the schema or assigning unique identifiers. These tasks are assigned to FSMO (Flexible Single Master Operations) roles, and each role sits on only one domain controller at any given moment.
The Five FSMO Roles
At the forest level, one instance for the entire forest:
- Schema Master: the only place the schema, meaning the definition of object types and attributes, can be changed; for example, when installing Exchange or extending the schema for LAPS.
- Domain Naming Master: adds and removes domains in the forest.
At the level of each domain:
- RID Master: gives each domain controller a pool of relative identifiers (RIDs) so every new object, such as a user or group, gets a unique security identifier.
- PDC Emulator: the domain’s time source, where password changes are recorded immediately, the coordinator for account lockouts, and the default target for Group Policy editing. This role is felt more than any other in daily operations.
- Infrastructure Master: keeps references to objects in other domains up to date. In a single-domain forest, or when all domain controllers are Global Catalogs, it has little practical importance.
If a Role Holder Becomes Unavailable
A short outage of most roles is not noticed right away, but:
- Losing the PDC Emulator is usually noticed first: inconsistent password changes and account lockouts, plus gradual clock drift that, if it continues, leads to Kerberos authentication errors.
- If the RID Master is unavailable, each domain controller can keep creating objects until its current RID pool runs out. After that, new users and groups cannot be created.
- Without the Schema Master and Domain Naming Master, daily work continues, but schema extensions and forest structure changes cannot be made.
Finding and Transferring Roles
To see who holds the roles, use netdom query fsmo, or in PowerShell use Get-ADDomain and Get-ADForest.
A transfer is done when both domain controllers are healthy and reachable, for example before decommissioning an old server. Sample command:
Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster
Forest-level roles can be transferred with the same command by adding SchemaMaster and DomainNamingMaster. Before transferring, check replication health with repadmin /replsummary.
Seizing: Emergencies Only
If the domain controller holding a role is permanently lost, for example its hardware is destroyed and it cannot be brought back, seize the role on another domain controller using the same command with the -Force parameter.
A domain controller whose role has been seized must never be reconnected to the network. Two holders of the same role, especially RID Master, can cause serious inconsistencies in Active Directory. After seizing, remove that server’s data from the domain with Metadata Cleanup.
Placement and Maintenance
- In small and mid-sized businesses, keeping all roles on one stable domain controller is common, acceptable and simpler to manage.
- The PDC Emulator is the root of domain time. Sync it with a reliable NTP source, for example with
w32tm /config /manualpeerlist:"pool.ntp.org" /syncfromflags:manual /reliable:yes /update. If this server is a virtual machine, also check for conflicting time sync from the virtualization host. - Document where the roles are and update the documentation after every transfer.
- Always keep at least one healthy, tested backup of your domain controllers.
Checklist
- You know which domain controller holds each of the five roles.
- The PDC Emulator syncs with a reliable time source.
- Roles are transferred before any domain controller is decommissioned.
- The technical team understands the difference between transferring and seizing.
- Domain controller backups are healthy and tested.
ITPlus724 engineers can review the state of your FSMO roles and the health of your domain controllers, and carry out transfers or recovery with a clear plan and minimal risk.