In Active Directory on Server 2008, FSMO stands for Flexible Single Master Operation. The different FSMO roles are as follows:
- Schema Master: schema=(defines default AD object properties in a template, like what a user is and what a server is), manages schema
- Domain Naming Master: create or remove new domains in a forest
- PDC: time server, backwards compatibility with older DCs
- RID Pool manager: assigns Relative IDs to AD objects from a pool of IDs
- Infrastructure Master: queries other domains to see what changes had been made in that made and sees if those objects have any references in its own domain, and updates its own objects correspondingly
These are the different roles that are held by Active Directory Servers. A few years ago, in an IT admin’s worst nightmare: The Main Server 2008 AD server (which held all 5 FSMO roles) was down, and would not boot up. Fortunately there was a backup Domain Controller (which had all of Active Directory replicated onto it). But since the Primary DC would not boot up, all the FSMO roles had to be forcibly seized and moved from the Primary DC and to the backup DC.
The setup was 2 Server 2008 AD servers-a primary one with all 5 FSMO roles on it (let’s call it DC1), and a backup DC which just had AD replicated onto it (let’s call it DC2). There was also an Exchange 2007 machine. Since DC1 wouldn’t boot, all the FSMO roles had to be forcibly seized and moved to DC2. Then Server 2008 had to be reinstalled on DC1 and the FSMO roles had to be gracefully moved back to DC1. Below were the steps:
//////////////////////////////////////////////////////////////////////////////////seize fsmo roles
Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.
C:\Users\Administrator.DOMAIN>ntdsutil ntdsutil: roles fsmo maintenance: con server connections: con t DC1 localhost Binding to localhost ... Connected to localhost using credentials of locally logged on user. server connections: q fsmo maintenance: seize schema master Attempting safe transfer of schema FSMO before seizure. ldap_modify_sW error 0x34(52 (Unavailable). Ldap extended error message is 000020AF: SvcErr: DSID-03210380, problem 5002 (UN AVAILABLE), data 1722
Win32 error returned is 0x20af(The requested FSMO operation failed. The current FSMO holder could not be contacted.)
)
Depending on the error code this may indicate a connection, ldap, or role transfer error.
Transfer of schema FSMO failed, proceeding with seizure … server “localhost” knows about 5 roles
Schema - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: seize pdc Attempting safe transfer of PDC FSMO before seizure. ldap_modify_sW error 0x34(52 (Unavailable). Ldap extended error message is 000020AF: SvcErr: DSID-03210575, problem 5002 (UN AVAILABLE), data 1722
Win32 error returned is 0x20af(The requested FSMO operation failed. The current FSMO holder could not be contacted.)
)
Depending on the error code this may indicate a connection, ldap, or role transfer error.
Transfer of PDC FSMO failed, proceeding with seizure … server “localhost” knows about 5 roles
Schema - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: seize rid master Attempting safe transfer of RID FSMO before seizure. ldap_modify_sW error 0x34(52 (Unavailable). Ldap extended error message is 000020AF: SvcErr: DSID-03210B34, problem 5002 (UN AVAILABLE), data 1722
Win32 error returned is 0x20af(The requested FSMO operation failed. The current FSMO holder could not be contacted.)
)
Depending on the error code this may indicate a connection, ldap, or role transfer error.
Transfer of RID FSMO failed, proceeding with seizure … Searching for highest rid pool in domain server “localhost” knows about 5 roles
Schema - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: sieze domainnamingmaster Error parsing Input - Invalid Syntax. fsmo maintenance: seize domainnamingmaster Error parsing Input - Invalid Syntax. fsmo maintenance: seize namingmaster Error parsing Input - Invalid Syntax. fsmo maintenance: seize naming master Attempting safe transfer of domain naming FSMO before seizure. ldap_modify_sW error 0x34(52 (Unavailable). Ldap extended error message is 000020AF: SvcErr: DSID-03210380, problem 5002 (UN AVAILABLE), data 1722
Win32 error returned is 0x20af(The requested FSMO operation failed. The current FSMO holder could not be contacted.)
)
Depending on the error code this may indicate a connection, ldap, or role transfer error.
Transfer of domain naming FSMO failed, proceeding with seizure … server “localhost” knows about 5 roles
Schema - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: seize infrastructure master Attempting safe transfer of infrastructure FSMO before seizure. ldap_modify_sW error 0x34(52 (Unavailable). Ldap extended error message is 000020AF: SvcErr: DSID-03210380, problem 5002 (UN AVAILABLE), data 1722
Win32 error returned is 0x20af(The requested FSMO operation failed. The current FSMO holder could not be contacted.)
)
Depending on the error code this may indicate a connection, ldap, or role transfer error.
Transfer of infrastructure FSMO failed, proceeding with seizure … server “localhost” knows about 5 roles
Schema - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: q ntdsutil: q C:\Users\Administrator.DOMAIN>netdom
The syntax of this command is:
NETDOM [ ADD | COMPUTERNAME | HELP | JOIN | MOVE | QUERY | REMOVE |
MOVENT4BDC | RENAMECOMPUTER | RESET | TRUST | VERIFY | RESETPWD ]
The command completed successfully.
C:\Users\Administrator.DOMAIN>netdom query fsmo Schema master DC2.DOMAIN.FOREST.com Domain naming master DC2.DOMAIN.FOREST.com PDC DC2.DOMAIN.FOREST.com RID pool manager DC2.DOMAIN.FOREST.com Infrastructure master DC2.DOMAIN.FOREST.com
The command completed successfully.
////////////////clean up metadata and AD objects
Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation. All rights reserved.
C:\Users\Administrator.DOMAIN>ntdsutil
ntdsutil: m c
metadata cleanup: con
server connections: con t DC1 localhost
Binding to localhost ...
Connected to localhost using credentials of locally logged on user.
server connections: rescue
Error parsing Input - Invalid Syntax.
server connections: q
metadata cleanup: li dom
Error parsing Input - Invalid Syntax.
metadata cleanup: select
Error parsing Input - Invalid Syntax.
metadata cleanup: select operation target
select operation target: list events
Error parsing Input - Invalid Syntax.
select operation target: list domains
Found 1 domain(s)
0 - DC=DOMAIN,DC=FOREST,DC=com
select operation target: select domain 0
No current site
Domain - DC=DOMAIN,DC=FOREST,DC=com
No current DC1
No current Naming Context
select operation target: list sites
Found 1 site(s)
0 - CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=c
om
select operation target: select site 0
Site - CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,D
C=com
Domain - DC=DOMAIN,DC=FOREST,DC=com
No current DC1
No current Naming Context
select operation target: list DC1 in site
Found 2 DC1(s)
0 - CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC
=DOMAIN,DC=FOREST,DC=com
1 - CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC
=DOMAIN,DC=FOREST,DC=com
select operation target: select DC1 0
Site - CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,D
C=com
Domain - DC=DOMAIN,DC=FOREST,DC=com
DC1 - CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurati
on,DC=DOMAIN,DC=FOREST,DC=com
DSA object - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site
-Name,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com
DNS host name - DC1.DOMAIN.FOREST.com
Computer object - CN=DC1,OU=Domain Controllers,DC=DOMAIN,DC=FOREST,DC=
com
No current Naming Context
select operation target: q
metadata cleanup: remove select DC1
Transferring / Seizing FSMO roles off the selected DC1.
Removing FRS metadata for the selected DC1.
Searching for FRS members under "CN=DC1,OU=Domain Controllers,DC=DOMAIN,DC=ea
cpc,DC=com".
Deleting subtree under "CN=DC1,OU=Domain Controllers,DC=DOMAIN,DC=FOREST,DC=co
m".
The attempt to remove the FRS settings on CN=DC1,CN=servers,CN=Default-First-
Site-Name,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com failed because "El
ement not found.";
metadata cleanup is continuing.
"CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=of
fice,DC=FOREST,DC=com" removed from server "localhost"
metadata cleanup: q
ntdsutil: q
C:\Users\Administrator.DOMAIN>adsiedit.msc //check different parts of the AD to make sure it's healthy
//recursively look at all subnodes of "Active Directory Domain Services" node in snapin (including Active Directory Users and Computer and Active Directory Sites and Services) to remove any reference to the hostname or IP address of the deleted DC1
SyncAll terminated with no errors.
//TRANSFER fsmo roles back to the old DC1, with a newly installed Server 2008. The following is a graceful transfer, not a forceful FSMO seize like above Microsoft Windows [Version 6.0.6002] Copyright (c) 2006 Microsoft Corporation. All rights reserved. C:\Users\Administrator.DOMAIN>ntdsutil ntdsutil: roles fsmo maintenance: connections server connections: connect to DC1 localhost Binding to localhost ... Connected to localhost using credentials of locally logged on user. server connections: q fsmo maintenance: transfer schema master server "localhost" knows about 5 roles Schema - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: transfer pdc server "localhost" knows about 5 roles Schema - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: transfer namingmaster Error parsing Input - Invalid Syntax. fsmo maintenance: transfer naming master server "localhost" knows about 5 roles Schema - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: transfer infrastructure master server "localhost" knows about 5 roles Schema - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC2,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: transfer rid master Operation cancelled fsmo maintenance: transfer rid master server "localhost" knows about 5 roles Schema - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sit es,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Naming Master - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name ,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com PDC - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com RID - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Name,CN=Sites, CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com Infrastructure - CN=NTDS Settings,CN=DC1,CN=servers,CN=Default-First-Site-Nam e,CN=Sites,CN=Configuration,DC=DOMAIN,DC=FOREST,DC=com fsmo maintenance: q ntdsutil: q C:\Users\Administrator.DOMAIN>net dom
The syntax of this command is:
NET
[ ACCOUNTS | COMPUTER | CONFIG | CONTINUE | FILE | GROUP | HELP |
HELPMSG | LOCALGROUP | PAUSE | PRINT | SESSION | SHARE | START |
STATISTICS | STOP | TIME | USE | USER | VIEW ]
C:\Users\Administrator.DOMAIN>net dom query fsmo
The syntax of this command is:
NET
[ ACCOUNTS | COMPUTER | CONFIG | CONTINUE | FILE | GROUP | HELP |
HELPMSG | LOCALGROUP | PAUSE | PRINT | SESSION | SHARE | START |
STATISTICS | STOP | TIME | USE | USER | VIEW ]
The command completed successfully.
//////////////dcpromo settings from DC1.DOMAIN.FOREST.com ; DCPROMO unattend file (automatically generated by dcpromo) ; Usage: ; dcpromo.exe /unattend:C:\Users\Administrator.DOMAIN\Desktop\dcpromo.txt ; ; You may need to fill in password fields prior to using the unattend file. ; If you leave the values for "Password" and/or "DNSDelegationPassword" ; as "*", then you will be asked for credentials at runtime. ; [DCInstall] ; Replica DC promotion ReplicaOrNewDomain=Replica ReplicaDomainDNSName=DOMAIN.FOREST.com SiteName=Default-First-Site-Name InstallDNS=Yes ConfirmGc=Yes CreateDNSDelegation=Yes DNSDelegationUserName=* DNSDelegationPassword=* UserDomain=DOMAIN.FOREST.com UserName=* Password=* DatabasePath="C:\Windows\NTDS" LogPath="C:\Windows\NTDS" SYSVOLPath="C:\Windows\SYSVOL" ; Set SafeModeAdminPassword to the correct value prior to using the unattend file SafeModeAdminPassword= ; Run-time flags (optional) ; CriticalReplicationOnly=Yes ; RebootOnCompletion=Yes
By: Neil Sikka