Finding the FSMO Role Holders
Monday, March 3rd, 2008Several Active Directory operations are sensitive, such as updating the schema, and therefore need to be done on a single domain controller. Active Directory cannot guarantee the proper execution of these functions in a situation where they may be invoked from more than one DC. The FSMO mechanism is used to limit these functions to a single DC.
There are five designated FSMO roles that correspond to these sensitive functions. A FSMO role can apply either to an entire forest or to a specific domain. Each role is stored in the fSMORoleOwner attribute on various objects in Active Directory depending on the role.
|
Role |
Description |
fSMORoleOwner location |
Domain- or forest-wide? |
|---|---|---|---|
|
Schema |
Processes schema updates |
CN=Schema,CN=Configuration, <ForestDN> |
Forest |
|
Domain Naming |
Processes the addition, removal, and renaming of domains |
CN=Partitions,CN=Configuration, <ForestDN> |
Forest |
|
Infrastructure |
Maintains references to objects in other domains |
CN=Infrastructure,<DomainDN> |
Domain |
|
RID |
Handles RID pool allocation for the domain controllers in a domain |
CN=RidManager$, CN=System,<DomainDN> |
Domain |
|
PDC Emulator |
Acts as the domain master browser and as the PDC for downlevel clients and Backup Domain Controllers (BDCs) |
<DomainDN> |
Domain |
Using a graphical user interface
For the Schema Master:
- Open the Active Directory Schema snap-in.
- Right-click on Active Directory Schema in the left pane and select Operations Master.
For the Domain Naming Master:
- Open the Active Directory Domains and Trusts snap-in.
- Right-click on Active Directory Domains and Trusts in the left pane and select Operations Master.
For the PDC Emulator, RID Master, and Infrastructure Master:
- Open the Active Directory Users and Computers snap-in.
- Make sure you’ve targeted the correct domain.
- Right-click on Active Directory Users and Computers in the left pane and select Operations Master.
- There are individual tabs for the PDC, RID, and Infrastructure roles.
Using a command-line interface
In the following command, you can leave out the /Domain option to query the domain in which you are currently logged on:
> netdom query fsmo /Domain:
You can also use the dsquery server command to list the FSMO role owners as shown here where can be schema, name, infr, pdc, or rid:
> dsquery server -hasfsmo
Using VBScript
' This code prints the FSMO role owners for the specified domain.
' ------ SCRIPT CONFIGURATION ------
strDomain = "" ' e.g., emea.rallencorp.com
' ------ END CONFIGURATION ---------
set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE") strDomainDN = objRootDSE.Get("defaultNamingContext") strSchemaDN = objRootDSE.Get("schemaNamingContext") strConfigDN = objRootDSE.Get("configurationNamingContext")
' PDC Emulator set objPDCFsmo = GetObject("LDAP://" & strDomainDN) Wscript.Echo "PDC Emulator: " & objPDCFsmo.fsmoroleowner
' RID Master set objRIDFsmo = GetObject("LDAP://cn=RID Manager$,cn=system," & strDomainDN) Wscript.Echo "RID Master: " & objRIDFsmo.fsmoroleowner
' Schema Master set objSchemaFsmo = GetObject("LDAP://" & strSchemaDN) Wscript.Echo "Schema Master: " & objSchemaFsmo.fsmoroleowner
' Infrastructure Master set objInfraFsmo = GetObject("LDAP://cn=Infrastructure," & strDomainDN) Wscript.Echo "Infrastructure Master: " & objInfraFsmo.fsmoroleowner
' Domain Naming Master set objDNFsmo = GetObject("LDAP://cn=Partitions," & strConfigDN) Wscript.Echo "Domain Naming Master: " & objDNFsmo.fsmoroleowner