Published: 17 Mar 2023
Editor's note: Adam Bertram originally wrote this article, and Liam Cleary has expanded it.
Flexible Single Master Operation roles are specialized tasks in an Active Directory forest that only one domain controller can perform at a time. These roles are required for proper functioning and managing an AD environment.
Several scenarios can require migrating or transferring FSMO roles in AD from one domain controller to another. Here are a few examples:
In all of these scenarios, transferring FSMO roles is necessary to ensure the availability and reliability of the AD environment. Planning and executing the transfer is essential to minimize the effect on users and applications.
Before you get startedTo find and move FSMO roles using PowerShell, you must take the following steps:
There are five FSMO roles in an AD forest, each with a specific purpose:
AD assigns each FSMO role to a specific domain controller. The roles must distribute and function correctly to maintain a healthy AD environment.
Use PowerShell to find FSMO rolesTo find the FSMO roles in AD using PowerShell, you can use two commands: Get-AdDomain and Get-AdForest. These commands are necessary because some FSMO roles are at the forest level, while others are at the domain level.
Using the Get-AdForest command, you can identify which domain controllers hold the DomainNamingMaster and SchemaMaster roles.
Get-ADForest | Select-Object DomainNamingMaster, SchemaMaster | Format-ListUse the Get-AdForest command to retrieve the domain controllers assigned to the DomainNamingMaster and SchemaMaster roles.
The Get-AdDomain command lets you identify which domain controllers hold InfrastructureMaster, PDCEmulator and RIDMaster roles.
Get-ADDomain | Select-Object InfrastructureMaster, PDCEmulator, RIDMaster | Format-ListUse the Get-AdDomain command to retrieve the domain controllers assigned to the InfrastructureMaster, PDCEmulator and RIDMaster roles.
To make it easier, combine these commands into a function you can use when writing a reusable script.
function Get-AdFsmoRoles {
[pscustomobject]@{
InfrastructureMaster = (Get-ADDomain).InfrastructureMaster
PDCEmulator = (Get-ADDomain).PDCEmulator
RIDMaster = (Get-ADDomain).RIDMaster
DomainNamingMaster = (Get-ADForest).DomainNamingMaster
SchemaMaster = (Get-ADForest).SchemaMaster
}
}
Using this function, you can then access the various property values using either of these approaches:
(Get-AdFsmoRoles).InfrastructureMaster$results = Get-AdFsmoRoles
$results.InfrastructureMaster
If you need to check for FSMO roles across all domain controllers, you can use PowerShell like this:
foreach ($dc in $domainControllers)How to transfer FSMO roles
{Write-Host "Domain Controller: $($dc.Name)"
$dcInfo = Get-ADDomainController -Identity $dc.Name
if ($dcInfo.OperationMasterRoles) {
$dcInfo | `
Select-Object Name, Domain, Forest, OperationMasterRoles | `
Format-Table -AutoSize
}
else
{
Write-Host "No FSMO roles found."
}
}
Now that you have checked where the FSMO roles reside, you can move them by calling Move-ADDirectoryServerOperationMasterRole, setting the domain controller and the role to move.
$domainController = "WIN2019BDC"
Move-ADDirectoryServerOperationMasterRole `
-Identity $domainController `
-OperationMasterRole PDCEmulator
The PowerShell command also accepts the use of splatting:
$params = @{
Identity = $domainController
OperationMasterRole = "RIDMaster"
}
Move-ADDirectoryServerOperationMasterRole @params
Once executed, you can then check the location of the FSMO roles.
Use PowerShell functions to retrieve FSMO role holders at the domain and forest levels.Finding the FSMO role holders before moving them is unnecessary, but knowing the state before making these significant changes is helpful.
How to seize FSMO rolesSometimes, you need to seize the FSMO roles from other domain controllers. Seizing FSMO roles is taking over the role from the domain controller that has permanently failed or is no longer available. You can't simply move roles; you must seize them. It's important to note that seizing an FSMO role should be done as a last resort after all other methods of transferring the role have failed or are impossible. Seizing an FSMO role should only be done if the previous holder is permanently unavailable and there is no chance of it returning to service.
This process is the same as the normal move; however, you add the -Force parameter to the command. If you were seizing the RIDMaster role, PowerShell changes to this:
$domainController = "WIN2019BDC"Use the -Force parameter to seize FSMO roles when the domain controller is unavailable or fails.
$params = @{
Identity = $domainController
OperationMasterRole = "RIDMaster"
}
Move-ADDirectoryServerOperationMasterRole @params -Force
Once completed, you can execute the function you created earlier, Get-AdFsmoRoles, to confirm that the roles now reside on the selected domain controller.
In general, transferring FSMO roles using PowerShell is a straightforward process. You can transfer FSMO roles to ensure redundancy and fault tolerance in your AD environment. However, it's essential to plan the moves carefully, considering the requirements for each FSMO role and the effect of the transfer on your domain. With careful planning and attention to detail, you can confidently transfer FSMO roles and maintain the integrity and availability of your AD environment.
Next StepsHow to upload and download files with PowerShell FTP script
How to test PowerShell code with Pester
Best practices for using PowerShell ISE for scripting
Dig Deeper on Microsoft messaging and collaborationRetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4