How to transfer or seize FSMO roles
The first Microsoft Windows 2000 Active Directory (AD) domain controller in a forest is granted five FSMO roles when you run the Dcpromo.exe program and install the AD. There are two FSMO roles that are forest wide and three that are per domain. If child domains are created, the two forest wide roles do not change. A forest with two domains would have eight FSMOs; two for the forest and three domain specific FSMO roles in each domain.
The five FSMO roles are:
• Schema master – Forest wide and one per forest.
• Domain naming master – Forest wide and one per forest.
• RID master – Domain Specific and one for each domain.
• PDC emulator – Domain Specific and one for each domain.
• Infrastructure master – Domain Specific and one for each domain.
If you only have one server (like SBS) it holds all the roles, if you have multiple domain controllers there is a chance that the roles have been divided to other servers (by whomever installed the forest…).
In order to find out which server holds which role you can use the following command on one of the servers:
Ntdsutil roles Connections “Connect to server<ServerName> ” Quit “select Operation Target” “List roles for connected server” Quit Quit Quit
**replace <ServerName> with the name of one of your DC’s
OR
Open command prompt and type netdom query fsmo
To move the FSMO roles from one computer to another, you can use two different methods. You can use the first method if both computers are running. This method is a Transfer and is the method that is recommended. Use the second method if the FSMO roles holder is offline. The second method requires you to use the Ntdsutil.exe tool to seize the roles.
NOTE: Only seize the FSMO roles to the remaining Active Directory domain controllers if you are removing the FSMO role holder from the domain or forest.
Transfer FSMO roles
To transfer the FSMO roles by using the Ntdsutil utility, follow these steps:
1. Log on to a Windows 2000 Server-based or Windows Server 2003-based member computer or domain controller that is located in the forest where FSMO roles are being transferred. We recommend that you log on to the domain controller that you are assigning FSMO roles to. The logged-on user should be a member of the Enterprise Administrators group to transfer Schema master or Domain naming master roles, or a member of the Domain Administrators group of the domain where the PDC emulator, RID master and the Infrastructure master roles are being transferred.
2. Click Start, click Run, type ntdsutil in the Open box, and then click OK.
3. Type roles, and then press ENTER.
Note To see a list of available commands at any one of the prompts in the Ntdsutil utility, type? and then press ENTER.
4. Type connections, and then press ENTER.
5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.
6. At the server connections prompt, type q, and then press ENTER.
7. Type transfer role, where role is the role that you want to transfer. For a list of roles that you can transfer, type? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article.
For example,
To transfer the Domain Naming master role, type transfer naming master
To transfer the infrastructure master role, type transfer infrastructure master
To transfer the Domain Naming master role, type transfer pdc
To transfer the RID master role, type transfer rid master
To transfer the Domain Naming master role, type transfer schema master
Note: The one exception is for the PDC emulator role, whose syntax is transfer pdc, not transfer pdc emulator.
8. At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.
Seize FSMO roles
To seize or transfer the FSMO roles by using Ntdsutil, follow these steps:
2. Click Start, click Run, type ntdsutil in the Open box, and then click OK.
3. Type roles, and then press ENTER.
4. Type connections, and then press ENTER.
5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to use.
6. At the server connections prompt, type q, and then press ENTER.
7. Type seize role, where role is the role that you want to seize. At the fsmo maintenance prompt, and then press ENTER,
For example,
To seize the Domain Naming master role, type seize naming master
To seize the infrastructure master role, type seize infrastructure master
To seize the Domain Naming master role, type seize pdc
To seize the RID master role, type seize rid master
To seize the Domain Naming master role, type seize schema master
Notes• Under typical conditions, all five roles must be assigned to “live” domain controllers in the forest. If a domain controller that owns a FSMO role is taken out of service before its roles are transferred, you must seize all roles to an appropriate and healthy domain controller.
If the domain controller that formerly held any FSMO role is not present in the domain and if it has had its roles seized by using the steps in this post, remove it from the Active Directory by following the procedure that is outlined in the following Microsoft Knowledge Base article: 216498 (http://support.microsoft.com/kb/216498/) How to remove data in active directory after an unsuccessful domain controller demotion.
Original Post:
The first Microsoft Windows 2000 Active Directory (AD) domain controller in a forest is granted five FSMO roles when you run the Dcpromo.exe program and install the AD. There are two FSMO roles that are forest wide and three that are per domain. If child domains are created, the two forest wide roles do not change. A forest with two domains would have eight FSMOs; two for the forest and three domain specific FSMO roles in each domain.
The five FSMO roles are:
• Schema master – Forest wide and one per forest.
• Domain naming master – Forest wide and one per forest.
• RID master – Domain Specific and one for each domain.
• PDC emulator – Domain Specific and one for each domain.
• Infrastructure master – Domain Specific and one for each domain.
If you only have one server (like SBS) it holds all the roles, if you have multiple domain controllers there is a chance that the roles have been divided to other servers (by whomever installed the forest…).
In order to find out which server holds which role you can use the following command on one of the servers:
Ntdsutil roles Connections “Connect to server<ServerName> ” Quit “select Operation Target” “List roles for connected server” Quit Quit Quit
**replace <ServerName> with the name of one of your DC’s
OR
Open command prompt and type netdom query fsmo
To move the FSMO roles from one computer to another, you can use two different methods. You can use the first method if both computers are running. This method is a Transfer and is the method that is recommended. Use the second method if the FSMO roles holder is offline. The second method requires you to use the Ntdsutil.exe tool to seize the roles.
NOTE: Only seize the FSMO roles to the remaining Active Directory domain controllers if you are removing the FSMO role holder from the domain or forest.
Transfer FSMO roles
To transfer the FSMO roles by using the Ntdsutil utility, follow these steps:
1. Log on to a Windows 2000 Server-based or Windows Server 2003-based member computer or domain controller that is located in the forest where FSMO roles are being transferred. We recommend that you log on to the domain controller that you are assigning FSMO roles to. The logged-on user should be a member of the Enterprise Administrators group to transfer Schema master or Domain naming master roles, or a member of the Domain Administrators group of the domain where the PDC emulator, RID master and the Infrastructure master roles are being transferred.
2. Click Start, click Run, type ntdsutil in the Open box, and then click OK.
3. Type roles, and then press ENTER.
Note To see a list of available commands at any one of the prompts in the Ntdsutil utility, type? and then press ENTER.
4. Type connections, and then press ENTER.
5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.
6. At the server connections prompt, type q, and then press ENTER.
7. Type transfer role, where role is the role that you want to transfer. For a list of roles that you can transfer, type? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article.
For example,
To transfer the Domain Naming master role, type transfer naming master
To transfer the infrastructure master role, type transfer infrastructure master
To transfer the Domain Naming master role, type transfer pdc
To transfer the RID master role, type transfer rid master
To transfer the Domain Naming master role, type transfer schema master
Note: The one exception is for the PDC emulator role, whose syntax is transfer pdc, not transfer pdc emulator.
8. At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.
Seize FSMO roles
To seize or transfer the FSMO roles by using Ntdsutil, follow these steps:
2. Click Start, click Run, type ntdsutil in the Open box, and then click OK.
3. Type roles, and then press ENTER.
4. Type connections, and then press ENTER.
5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to use.
6. At the server connections prompt, type q, and then press ENTER.
7. Type seize role, where role is the role that you want to seize. At the fsmo maintenance prompt, and then press ENTER,
For example,
To seize the Domain Naming master role, type seize naming master
To seize the infrastructure master role, type seize infrastructure master
To seize the Domain Naming master role, type seize pdc
To seize the RID master role, type seize rid master
To seize the Domain Naming master role, type seize schema master
Notes• Under typical conditions, all five roles must be assigned to “live” domain controllers in the forest. If a domain controller that owns a FSMO role is taken out of service before its roles are transferred, you must seize all roles to an appropriate and healthy domain controller.
If the domain controller that formerly held any FSMO role is not present in the domain and if it has had its roles seized by using the steps in this post, remove it from the Active Directory by following the procedure that is outlined in the following Microsoft Knowledge Base article: 216498 (http://support.microsoft.com/kb/216498/) How to remove data in active directory after an unsuccessful domain controller demotion.
Original Post:
No comments:
Post a Comment