How to Transfer FSMO roles to another Domain Controller

by

In the realm of Windows server management, Active Directory stands as the bedrock for centralized authentication, authorization, and directory services. Understanding its intricacies, especially when it comes to Flexible Single Master Operations (FSMO) roles, is crucial for maintaining a healthy and efficient directory infrastructure. FSMO roles are specialized tasks assigned to specific domain controllers within an Active Directory forest, ensuring smooth operation and data consistency across the network.

Today, we delve into the process of transferring FSMO roles between domain controllers. This guide serves as a beacon for IT administrators navigating the complexities of Active Directory management.

Understanding FSMO Roles

FSMO roles are divided into two categories: forest-wide roles and domain-wide roles. The forest-wide roles include:

  1. Schema Master: Manages updates to the Active Directory schema.
  2. Domain Naming Master: Controls the addition or removal of domains in the forest.

Meanwhile, the domain-wide roles consist of:

  1. Relative ID (RID) Master: Allocates relative identifiers for objects within a domain.
  2. Primary Domain Controller (PDC) Emulator: Synchronizes time across the domain and handles password changes.
  3. Infrastructure Master: Manages cross-domain object references.

Each FSMO role plays a critical part in maintaining the integrity and functionality of the Active Directory environment. Should a domain controller hosting any of these roles become unavailable or require decommissioning, transferring these roles to another domain controller ensures continuity without disruption.

Why Transfer FSMO roles?

By default, when Active Directory is installed all five FSMO roles are assigned to the first domain controller in the forest root domain. Transferring FSMO roles is often needed for several reasons including:

  • Upgrading the operating system
  • Changing IP addresses on a domain controller
  • Demoting a domain controller
  • Taking a domain controller offline for maintenance
  • Performance issues

Transfer can be done by 2 options:

1: From GUI

2: From PowerShell

First, we need to move Forest wide roles:

In order to check which DC have these roles deployed run the below PowerShell command:

Get-ADForest | select DomainNamingMaster, SchemaMaster

Now we know which have Domain Naming Master and Which have Schema Master roles

Let’s begin with the Transfer process:

1: Domain Naming Master:

Open PowerShell and login to DC03 (I am transferring the roles to this DC)

Transfer DomainNamingMaster

Move-ADDirectoryServerOperationMasterRole -Identity "DC03"DomainNamingmaster

From GUI:

Open server manager

Click on the tools and click Active Directory Domains and trust:

Right click on Active Directory Domains and trust> Click on Operations Master

Now click change to transfer the role to another DC

2: Schema Master role

Using PowerShell:

Move-ADDirectoryServerOperationMasterRole -Identity "DC03"SchemaMaster

From GUI:

Make sure you have the Schema Admin role assigned to your account to perform this task.

Open Command Prompt as Admin and type:

regsvr32 schmmgmt.dll

Open run and type MMC

Now you have MMC window open and click on file and then  > Add/Remove Snap-in

Now you will see Active Directory Schema and then click on Add and then Click OK.

Now on the left hand you will see the Active Directory Schema, right click on it and then Click on Change Active Directory Domain Controller:

Here we changed it to DC03

Now right click and you will see the operation master option to do the change:

Now click on change to set the DC03 to be an new Schema Master.

Now how can we transfer Domain Wide roles:

From GUI

1: Go to Server Manager

2:  Click on tool and then go to ADSI edit or Active Directory users and Computer:

3:  Right click on the domain.local your active directory and then click on Operations Masters

4: To transfer one of these roles, simply click on the “Change” button. You cannot select the specific domain controller to transfer the role to through this interface. Therefore, you need to log into the server where you want to transfer the role. For example, if I wanted to transfer the RID role to DC03, I would log into DC03 for this operation.

From PowerShell:

Run the below command to check which DC have what roles assigned:

get-addomain | select InfrastructureMaster, PDCEmulator, RIDMaster

Now login to the DC03 where we wants to transfer the roles:

Transfer RIDMaster

Move-ADDirectoryServerOperationMasterRole -Identity "DC03" RIDMaster

Transfer InfrastrctureMaster

Move-ADDirectoryServerOperationMasterRole -Identity "DC03"Infrastructuremaster

Transfer PDCEmulator

Move-ADDirectoryServerOperationMasterRole -Identity " DC03" PDCEmulator

Conclusion

Mastering the transfer of FSMO roles within Active Directory is not merely a technical task but a strategic maneuver to maintain the stability and reliability of network operations. I hope my blog offering clear instructions and best practices for IT professionals tasked with managing FSMO roles.

As technology evolves, so too does the landscape of network administration. Keeping abreast of best practices and leveraging authoritative resources ensures that administrators can confidently navigate the complexities of Active Directory management, fostering a robust and resilient IT infrastructure.

For those embarking on this journey 365cloudit Team stands ready with comprehensive insights and guidance to empower administrators in their quest for mastery over Active Directory FSMO roles.

!!! THANKS FOR READING !!!

Regards,
HARISH KUMAR

Knowledge is not a finite resource to hoard; it’s a boundless treasure that grows when shared.