Metal Sushi

Transfer the FSMO Roles via NTDSUTIL

2010-01-19T00:46:00.000-08:00

Click Start, click Run, type ntdsutil in the Open box, and then click OK.
Type roles, and then press ENTER.
Type connections, and then press ENTER.
Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.
At the server connections prompt, type q, and then press ENTER.
Type transfer role, where role is the role that you want to transfer.

List of the FSMO roles:

Transfer domain naming master
Transfer infrastructure master
Transfer PDC
Transfer RID master
Transfer schema master

At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.

Metal Sushi

Seize the FSMO Roles via NTDSUTIL

2010-01-17T00:23:00.000-08:00

Click Start, click Run, type ntdsutil in the Open box, and then click OK.
Type roles, and then press ENTER.
Type connections, and then press ENTER.
Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.
At the server connections prompt, type q, and then press ENTER.
Type seize role, where role is the role that you want to transfer.

List of the FSMO roles:

Seize domain naming master
Seize infrastructure master
Seize PDC
Seize RID master
Seize schema master

At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.

Metal Sushi

Transfer the RID Master, PDC Emulator, and Infrastructure Master Roles via the GUI

2010-01-15T00:31:00.000-08:00

Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
Right-click Active Directory Users and Computers, and then click Connect to Domain Controller.

NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.

Do one of the following:
1. In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK.
2. -or-
3. In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.
In the console tree, right-click Active Directory Users and Computers, point to All Tasks, and then click Operations Master.
Click the appropriate tab for the role that you want to transfer (RID, PDC, or Infrastructure), and then click Change.
Click OK to confirm that you want to transfer the role, and then click Close.

Metal Sushi

Transfer the Domain Naming Master Role via the GUI

2010-01-13T00:30:00.000-08:00

Click Start, point to Administrative Tools, and then click Active Directory Domains and Trusts.
Right-click Active Directory Domains and Trusts, and then click Connect to Domain Controller.

NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.

Do one of the following:
1. In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK.
2. -or-
3. In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.
In the console tree, right-click Active Directory Domains and Trusts, and then click Operations Master.
Click Change.
Click OK to confirm that you want to transfer the role, and then click Close.

Metal Sushi

Transfer the Schema Master Role via the GUI

2010-01-11T00:30:00.000-08:00

Use the Active Directory Schema Master snap-in to transfer the schema master role. Before you can use this snap-in, you must register the Schmmgmt.dll file.

Register Schmmgmt.dll

Click Start, and then click Run.
Type regsvr32 schmmgmt.dll in the Open box, and then click OK.
Click OK when you receive the message that the operation succeeded.

Transfer the Schema Master Role

Click Start, click Run, type mmc in the Open box, and then click OK.
On the File, menu click Add/Remove Snap-in.
Click Add.
Click Active Directory Schema, click Add, click Close, and then click OK.
In the console tree, right-click Active Directory Schema, and then click Change Domain Controller.
Click Specify Name, type the name of the domain controller that will be the new role holder, and then click OK.
In the console tree, right-click Active Directory Schema, and then click Operations Master.
Click Change.
Click OK to confirm that you want to transfer the role, and then click Close.

Metal Sushi

How to Determine the FSMO Holders via DSQuery

2010-01-09T00:11:00.000-08:00

Schema Master Role

Click Start, click Run, type cmd in the Open box, and then press ENTER.
Type dsquery server -hasfsmo schema, and then press ENTER.

Domain Naming Master Role

Click Start, click Run, type cmd in the Open box, and then press ENTER.
Type dsquery server -hasfsmo name, and then press ENTER.

Infrastructure Master Role

Click Start, click Run, type cmd in the Open box, and then press ENTER.
Type dsquery server -hasfsmo infr, and then press ENTER.

PDC Emulator Role

Click Start, click Run, type cmd in the Open box, and then press ENTER.
Type dsquery server -hasfsmo pdc, and then press ENTER.

RID Master Role

Click Start, click Run, type cmd in the Open box, and then press ENTER.
Type dsquery server -hasfsmo rid, and then press ENTER.

Metal Sushi

How to Determine the FSMO Holders via a Netdom

2010-01-07T00:56:00.000-08:00

Click Start, click Run, type cmd in the Open box, and then press ENTER.
Type netdom query fsmo /Domain:<DomainDNSName>, and then press ENTER.

Metal Sushi

How to Determine the FSMO Holders via DCDiag

2010-01-05T00:54:00.000-08:00

Click Start, click Run, type cmd in the Open box, and then press ENTER.
Type DCdiag /test:Knowsofroleholders /v, and then press ENTER.

Metal Sushi

How to Determine the FSMO Holders via a NTDSUTIL Tool

2010-01-03T00:51:00.000-08:00

Click Start, click Run, type cmd in the Open box, and then press ENTER.
Type ntdsutil, and then press ENTER.
Type domain management, and then press ENTER.
Type connections, and then press ENTER.
Type connect to server ServerName, where ServerName is the Name of the Domain Controller you would like to view, and then press ENTER.
Type quit, and then press ENTER.
Type select operation target, and then press ENTER.
Type list roles for connected server, and then press ENTER.

Metal Sushi

How to Determine the FSMO Holders via a Batch Script

2010-01-01T00:01:00.000-08:00

The Windows 2000 Resource Kit contains a .cmd file called Dumpfsmos.cmd that you can use to quickly list FSMO role owners for your current domain and forest. The .cmd file uses Ntdsutil.exe to enumerate the role owners. The Dumpfsmos.cmd file contains:

@echo off

REM

REM Script to dump FSMO role owners on the server designated by %1

REM

if ""=="%1" goto usage

Ntdsutil roles Connections "Connect to server %1" Quit "select Operation Target" "List roles for connected server" Quit Quit Quit

goto done

:usage

@echo Please provide the name of a domain controller (i.e. dumpfsmos MYDC)

@echo.

:done

Metal Sushi

How to Determine the Domain Naming FSMO Holder in a Forest via the GUI

2009-12-31T00:41:00.000-08:00

Click Start, click Run, type mmc, and then click OK.
On the Console menu, click Add/Remove Snap-in, click Add, double-click Active Directory Domains and Trusts, click Close, and then click OK.
In the left pane, click Active Directory Domains and Trusts.
Right-click Active Directory Domains and Trust, and then click Operations Master to view the server holding the domain naming master role in the Forest.

Metal Sushi

How to Determine the Schema FSMO Holder in a Forest via the GUI

2009-12-29T00:41:00.000-08:00

Register Schmmgmt.dll

Click Start, and then click Run.
Type regsvr32 schmmgmt.dll in the Open box, and then click OK.
Click OK when you receive the message that the operation succeeded.

How to Determine the Schema FSMO Holder in a Forest via the GUI

Click Start, click Run, type mmc, and then click OK.
On the Console menu, click Add/Remove Snap-in, click Add, double-click Active Directory Schema, click Close, and then click OK.
Right-click Active Directory Schema in the top left pane, and then click Operations Masters to view the server holding the schema master role.

Metal Sushi

How to Determine the RID, PDC, and Infrastructure FSMO Holders of a Selected Domain via the GUI

2009-12-27T00:40:00.000-08:00

Click Start, click Run, type dsa.msc, and then click OK.
Right-click the selected Domain Object in the top left pane, and then click Operations Masters.
Click the PDC tab to view the server holding the PDC master role.
Click the Infrastructure tab to view the server holding the Infrastructure master role.
Click the RID Pool tab to view the server holding the RID master role.

Metal Sushi

Infrastructure Master FSMO Role

2009-12-25T00:20:00.000-08:00

When an object in one domain is referenced by another object in another domain, it represents the reference by the GUID, the SID (for references to security principals), and the DN of the object being referenced. The infrastructure FSMO role holder is the DC responsible for updating an object's SID and distinguished name in a cross-domain object reference.

NOTE: The Infrastructure Master (IM) role should be held by a domain controller that is not a Global Catalog server (GC). If the Infrastructure Master runs on a Global Catalog server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a Global Catalog server holds a partial replica of every object in the forest. As a result, cross-domain object references in that domain will not be updated and a warning to that effect will be logged on that DC's event log.

If all the domain controllers in a domain also host the global catalog, all the domain controllers have the current data, and it is not important which domain controller holds the infrastructure master role.

Metal Sushi

PDC Emulator FSMO Role

2009-12-23T00:19:00.000-08:00

The PDC emulator is necessary to synchronize time in an enterprise. Windows Server includes the W32Time (Windows Time) time service that is required by the Kerberos authentication protocol. All Windows computers within an enterprise use a common time. The purpose of the time service is to ensure that the Windows Time service uses a hierarchical relationship that controls authority and does not permit loops to ensure appropriate common time usage.

The PDC emulator of a domain is authoritative for the domain. The PDC emulator at the root of the forest becomes authoritative for the enterprise, and should be configured to gather the time from an external source. All PDC FSMO role holders follow the hierarchy of domains in the selection of their in-bound time partner.

In a domain, the PDC emulator role holder retains the following functions:

Password changes performed by other DCs in the domain are replicated preferentially to the PDC emulator.
Authentication failures that occur at a given DC in a domain because of an incorrect password are forwarded to the PDC emulator before a bad password failure message is reported to the user.
Account lockout is processed on the PDC emulator.
The PDC emulator performs all of the functionality that a Microsoft Windows NT 4.0 Server-based PDC or earlier PDC performs for Windows NT 4.0-based or earlier clients.
This part of the PDC emulator role becomes unnecessary when all workstations, member servers, and domain controllers that are running Windows NT 4.0 or earlier are all upgraded to Windows 2000. The PDC emulator still performs the other functions as described in a Windows 2000 environment.

Metal Sushi

RID Master FSMO Role

2009-12-21T00:18:00.000-08:00

The RID master FSMO role holder is the single DC responsible for processing RID Pool requests from all DCs within a given domain. It is also responsible for removing an object from its domain and putting it in another domain during an object move.

When a DC creates a security principal object such as a user or group, it attaches a unique Security ID (SID) to the object. This SID consists of a domain SID (the same for all SIDs created in a domain), and a relative ID (RID) that is unique for each security principal SID created in a domain.

Each DC in a domain is allocated a pool of RIDs that it is allowed to assign to the security principals it creates. When a DC's allocated RID pool falls below a threshold, that DC issues a request for additional RIDs to the domain's RID master. The domain RID master responds to the request by retrieving RIDs from the domain's unallocated RID pool and assigns them to the pool of the requesting DC. There is one RID master per domain in a directory.

Metal Sushi

Domain Naming Master FSMO Role

2009-12-19T00:18:00.000-08:00

The domain naming master FSMO role holder is the DC responsible for making changes to the forest-wide domain name space of the directory (that is, the Partitions\Configuration naming context or LDAP://CN=Partitions, CN=Configuration, DC=<domain>). This DC is the only one that can add or remove a domain from the directory. It can also add or remove cross references to domains in external directories.

Metal Sushi

Schema Master FSMO Role

2009-12-17T00:17:00.000-08:00

The schema master FSMO role holder is the DC responsible for performing updates to the directory schema (that is, the schema naming context or LDAP://cn=schema,cn=configuration,dc=<domain>). This DC is the only one that can process updates to the directory schema. Once the Schema update is complete, it is replicated from the schema master to all other DCs in the directory. There is only one schema master per directory.

Metal Sushi

Active Directory Single-Master Model

2009-12-15T00:17:00.000-08:00

To prevent conflicting updates in Active Directory performs updates to certain objects in a single-master fashion. In a single-master model, only one DC in the entire directory is allowed to process updates.

Active Directory extends the single-master model to include multiple roles, and the ability to transfer roles to any domain controller (DC) in the enterprise. Because an Active Directory role is not bound to a single DC, it is referred to as a Flexible Single Master Operation (FSMO) role. Currently there are five FSMO roles:

Schema master
Domain naming master
RID master
PDC emulator
Infrastructure daemon

Metal Sushi

NTDSUTIL - Commands with short cuts and descriptions

2009-11-25T00:01:00.000-08:00

NTDSUTIL

Commands with short cuts and descriptions

Command	Description
Activate instance %s short form: ac i %s	Sets NTDS or a specific AD LDS instance as the active instance.
authoritative restore Short form: au r	Authoritatively restores the Active Directory database or AD LDS instance.
Change service account %s1 %s2	Changes the AD LDS service account to user name %s1 and password %s2. Use "NULL" for a blank password. Use * to prompt the user to enter a password.
configurable settings Short form: co s	Manages configurable settings.
DS behavior Short form: ds b	Views and modifies AD DS or AD LDS behavior.
files Short form: f	Manages AD DS or AD LDS database files.
group membership evaluation Short form: g m e	Evaluates security IDs (SIDs) in the token for a given user or group.
Help	Shows this help information.
ifm Short form: i	Creates installation media for writable (full) and read-only domain controllers (RODCs) and instances of AD LDS.
LDAP policies	Manages Lightweight Directory Access Protocol (LDAP) protocol policies.
Ldap port %d	Configures an LDAP port for an AD LDS instance.
List instances Short form: li i	Lists all AD LDS instances that are installed on a computer.
local roles Short form: lo r	Manages local administrative roles on an RODC.
metadata cleanup Short form: m c	Cleans up objects of decommissioned servers.
partition management Short form: pa m	Manages directory partitions.
Popups off Short form: po off	Disables popups.
Popups on Short form: po on	Enables popups.
Quit Short form: q	Quits the command.
roles Short form: r	Transfers and seizes operations master roles.
security account management Short form: sec a m	Manages SIDs.
semantic database analysis Short form: sem d a	Verifies integrity of AD DS or AD LDS database files with respect to Active Directory semantics.
set DSRM password Short form: set d p	Resets the Directory Services Restore Mode (DSRM) administrator password.
snapshot Short form: sn	Manages snapshots of the volumes that contain the Active Directory database and log files.
SSL port %d	Configures a Secure Sockets Layer (SSL) port for an AD LDS instance.

NTDSUTIL Snapshot One Line Command - List mounted snapshot

2009-11-23T00:01:00.000-08:00

List mounted snapshot

C:\Windows\System32\ntdsutil.exe snapshot "list mounted" quit quit

Metal Sushi

NTDSUTIL Snapshot One Line Command - Unmount a snapshot

2009-11-21T00:01:00.000-08:00

Unmount a snapshot

C:\Windows\System32\ntdsutil.exe snapshot "mount {b2e4ddbe-c498-4311-84c3-d978d48eaf44} " quit quit

NOTE: {b2e4ddbe-c498-4311-84c3-d978d48eaf43} is just an example of the GUID

Metal Sushi

NTDSUTIL Snapshot One Line Command - Mount a snapshot

2009-11-19T00:01:00.000-08:00

Mount a snaphot

C:\Windows\System32\ntdsutil.exe snapshot "mount {b2e4ddbe-c498-4311-84c3-d978d48eaf44} " quit quit

NOTE: {b2e4ddbe-c498-4311-84c3-d978d48eaf43} is just an example of the GUID

Metal Sushi

NTDSUTIL Snapshot One Line Command - List all snapshots

2009-11-17T00:01:00.000-08:00

List all snapshots

C:\Windows\System32\ntdsutil.exe snapshot "list all" quit quit

Metal Sushi

NTDSUTIL Snapshot One Line Command - Delete a snapshot

2009-11-15T00:01:00.000-08:00

Delete a snapshot

C:\Windows\System32\ntdsutil.exe snapshot "list all" "delete 1" quit quit

Metal Sushi