Understanding and Managing Operations Master Roles

Understanding the Operations Master Roles

Active Directory operates in a multi-master replication manner. What this means is that each domain controller in the domain holds a readable, writable replica of the Active Directory data store. In multi-master replication, any domain controller is able to change objects within Active Directory. Multi-master replication is ideal for the majority of information located in Active Directory. However, certain Active Directory functions or operations are not managed in a multi-master manner because they cannot be shared without causing some data uniformity issues. These functions are called Flexible Single Master Operations (FSMOs).

There are five Operations Master (OM) roles which are automatically installed when you install the first domain controller. These five OMs are installed on the domain controller. Two of these OM roles apply to the entire Active Directory forest. The roles that apply to the forest are the Schema Master role and the Domain Naming Master role. The other three OM roles apply to each domain. The roles that apply to a domain are the Relative identifier (RID)/relative ID Master role, the Primary Domain Controller (PDC) Emulator role, and the Infrastructure Master role. When a domain controller is assigned a FSMO, that domain controller becomes a role master. The particular domain controller that is assigned these roles performs single-master replication within the Active Directory environment. Understanding and Managing Operations Master Roles

Because domain controllers generally contain the same Active Directory information, when one domain controller is unavailable, the remainder of the domain controllers are able to provide access to Active Directory objects. However, if the domain controller that is lost has one of these OM roles installed, you could find that no new objects can be added to the domain.

Forest-Wide Operations Master Roles

Each Forest-wide OM role can exist on only one domain controller in the entire forest. What this means is that these roles have to be unique in the entire forest. The two forest-wide OM roles are:

Schema Master role: Because the objects that exist in the in the schema directory partition define the Active Directory structure for a forest, great control is placed on who can add objects to this partition. Since each domain controller in an Active Directory environment have a common schema, the information in the schema has to be consistent on each domain controller. It is the domain controller that is assigned the Schema Master role that controls which objects are added, changed, or removed from the schema. The domain controller with the Schema Master role is the only domain controller in the entire Active Directory forest that can perform any changes to the schema. You can use the Active Directory Schema MMC snap-in to make changes to the schema, and only if you are a member of the Schema Admins group. Any changes made to the schema would affect each domain controller within the Active Directory forest. You can transfer the Schema Master role to a different domain controller within the forest. You can also seize the role if the existing domain controller holding the role had a failure and cannot be recovered.
Domain Naming Master role: As is the case with the Schema Master role, only one Domain Naming Master role is allowed in the entire forest. The domain controller that is assigned the Domain Naming Master role is responsible for tracking all the domains within the entire Active Directory forest to ensure that duplicate domain names are not created. The domain controller with the Domain Naming Master role is accessed when new domains are created for a tree or forest. This ensures that domains are not simultaneously created within the forest. The default configuration is that the first domain controller promoted in a forest, is assigned this role. You can however transfer the Domain Naming Master role to a different domain controller within te forest.

Domain-Wide Operations Master Roles

The three domain-wide OM roles have to unique in each domain within a forest. What this means is that there should be one of each of these roles in each domain. The three domain-wide OM roles are:

Relative identifier (RID) Master role: When a security object is created within Active Directory, it is allocated a security ID. The security ID is made up of the domain security ID and a relative ID. The domain security ID is exactly the same for each security ID created in the particular domain. The relative ID on the other hand is unique to each security ID created within the domain. Because each relative ID has to be unique, the domain controller that is assigned the RID Master role is responsible for tracking and for assigning unique relative IDs to domain controllers whenever new objects are created. To ensure efficiency when assigning relative IDs to domain controllers, the domain controller assigned the RID Master role actually generates a set of 500 relative IDs to allocate to domain controllers. As the number of available relative IDs decreases, the RID Master generates more relative IDs to maintain the number of relative IDs available as 500. The default configuration is that the RID Master role and PDC Emulator role is assigned to the identical domain controller. You can however transfer the RID Master role to a different domain controller within the domain.
PDC Emulator role: In domains that contain Windows NT Backup Domain Controllers (BDCs), the domain controller which is assigned the PDC Emulator role functions as the Windows NT Primary Domain Controller (PDC). The PDC Emulator role has importance when it comes to replication – BDCs only replicate from a Primary Domain Controller! Objects that are security principles can only be created and replicated by the PDC Emulator. Security principles are Users, Computers, and Groups. It is therefore the PDC Emulator that enables down-level operating systems to co-exist in Windows 2000 and Windows Server 2003 Active Directory environments. After the domain is operating in the Windows Server 2003 functional level, the domain controller assigned the PDC Emulator role continues to perform other operations for the domain.
These additional functions include the following:
- All password changes and account lockout requests are forwarded to the PDC Emulator. A domain controller within a domain checks first with the PDC Emulator to verify whether a bad password provided by a user was a recently changed password, and is therefore a valid password.
- Group policies consist of a Group Policy Container (GPC) in Active Directory, and a Group Policy Template (GPT) in the SYSVOL folder. Because these two items can become out of sync due to multi-master replication, the Group Policy Editor is by default set to the PDC Emulator. This prevents group policy changes from being made on all domain controllers within the domain.
Infrastructure Master role: The domain controller assigned the Infrastructure Master role has the following functions within the domain:
- Updates the group-to-user references when the members of groups are changed. These updates are sent by the Infrastructure Master to the remainder of the domain controllers within the domain via multi-master replication.
- Deletes any stale or invalid group-to-user references within the domain. To do this, the Infrastructure Master role checks with the Global Catalog for stale group-to-user references.

Planning the Placement of the FSMOs

A mentioned previously, all the OM roles are by default automatically assigned to the first domain controller created for the first domain in a new Active directory forest. Then, when you create either a root domain of a new tree in a forest, or a new child domain, the three domain specific OM roles are assigned to the first domain controller in that domain. In cases where a doain has only one domain controller, each domain specific OM role has to exist on that single domain controller. The two forest specific OM roles stay on the initial domain controller for the first domain created within the forest.

OM roles are usually transferred to other domain controllers when you need to perform maintenance activities, or load balance the existing load of the domain controllers, or simply move the particular OM role to a better equipped domain controller.

In instances where multiple domain controllers exist for a particular domain, consider the following recommendations when placing your Operations Master roles within the domain:

Where you have two domain controllers that are direct replication partners and are well-connected, assign the RID Master role, PDC Emulator role and Infrastructure Master role to one domain controller. This particular domain controller would become the OM domain controller for the domain. The remaining domain controller would become the designated standby OM domain controller.
It is generally recommended to assign the PDC Emulator and RID Master roles to the same domain controller.
However, if the domain which you are placing FSMO roles for is large in size, consider locating the RID Master role and PDC Emulator role on two different domain controllers. Each of these domain controllers should be well-connected to the domain controller designated as the standby OM domain controller for these two roles. This strategy is usually implemented to reduce the load on the domain controller assigned the PDC Emulator.
You should place the Schema Master role and the Domain Naming Master role on the same domain controller.
You should refrain from assigning the Infrastructure Master role to a domain controller that contains the Global Catalog. The domain controller assigned the Infrastructure Master role should be well-connected to the Global Catalog server. The Infrastructure Master would not operate correctly if the Global Catalog is hosted on the identical domain controller.

Managing Operations Master Roles

Since only one or a few domain controllers are assigned the Operations Master roles, it is important that these specific domain controllers remain functioning in the Active Directory environment. There are essentially two processes involved in the management of FSMOs. These management tasks are outlined below:

Because the FSMOs are automatically created when the first domain controller is installed, you might need to transfer OM roles to a more robust server. You would also need to transfer OM roles to a different server before demoting the domain controller hosting them.
When a lost domain controller cannot be recovered, you would to need any seize OM roles assigned to the particular domain controller.

Transferring an Operations Master role, involves moving it from one server to a different server. To transfer the Schema Master role, you need to have Schema Admins rights, and to transfer the Domain Naming Master role, you need to have Enterprise Admin rights.

You can use an Active Directory console or a command-line utility to transfer OM roles. The Active Directory MMC consoles that can be utilized to transfer the different FSMOs are outlined below:

Active Directory Schema MMC snap-in: For transferring the Schema Master role
Active Directory Domains and Trusts console: For transferring the Domain Naming Master role
Active Directory Users and Computers console: For transferring the RID Master role, PDC Emulator role, and Infrastructure Master role.

When you seize an OM role, you do it without the cooperation of the existing domain controller that is assigned with the particular OM role. When an OM role is seized, it is basically reassigned to a different domain controller. Before you attempt to seize any OM roles, first try to determine what the reason is for the filure of the existing domain controller which is assigned with the particular OM role. Certain network issues which are likely to be corrected in short time fames are well worth enduring through. Before you seize OM roles, first ensure that the domain controller you are planning to shift these roles to; is indeed powerful enough to uphold these roles. In summary, you should only really seize an OM role if the existing OM cannot be recovered again. You would need to use the Ntdsutil tool command-line tool to seize OM roles.

The Consequences of FSMOs Failing

The following section looks at what actually happens when each FSMO role fails:

A Schema Master failure is basically only evident when an Administrator attempts to change the Active Directory schema. What this means is that a Schema Master failure is invisible to your standard network users. You should only seize this role to the domain controller designated as the standby schema master if the existing Schema Master can in fact never be recovered.
As is the case with a Schema Master failure, Domain Naming Master failure is only evident if an Administrator is attempting to add a domain to the forest, or remove a domain from the forest. A Domain Naming Master failure can generally not be perceived by your standard network users. You should only seize this role to the domain controller designated as its standby when the existing Domain Naming Master would never be operational again.
A RID Master failure is only evident to Administrators if they are attempting to add new Active Directory objects in the particular domain where the RID Master failed. When this happens, the RID Master is unable to allocate relative IDs to the domain controllers on which the new Active Directory objects are being created. A RID Master failure cannot be detected by your conventional network users. You should also generally only seize this OM role when the existing domain controller assigned with the RID Master role would never recover from the failure.
An Infrastructure Master failure is also not visible to your standard network users. The failure only impacts Administrators that are attempting to move user accounts, or rename them. Consider moving the role to the designated standby domain controller if the existing domain controller assigned with the Infrastructure Master is to be unavailable for a reasonably extended period of time, and the changes that need to be made are pertinent.
Unlike the OM role failures previously described that are not evident to your standard network users, a PDC Emulator failure does impact network users. It is important to immediately seize this role to its designated standby domain controller if the domain contains any Windows NT backup domain controllers. You can always return this role to its previous domain controller when it is recovered and online again.

How to view the existing Schema Master role assignment

Open a command prompt, and enter regsvr32 schmmgmt.dll to register the schmmgmt.dll on the computer.
Click Start, Run, and enter mmc in the Run dialog box. Click OK.
From the File menu, select Add/Remove Snap-in and then select Add.
In the list of available snap-ins, double-click Active Directory Schema.
Click Close. Click OK.
Open the Active Directory Schema snap-in.
In the console tree, right-click Active Directory Schema and select Operations Masters from the shortcut menu.
The Change Schema Master dialog box opens.
You can view the name of the existing Schema Master in the Current Schema Master (Online) box.
Click Close.

How to view the existing Domain Naming Master role assignment

Open the Active Directory Domains And Trusts console from the Administrative Tools menu.
In the console tree, right-click Active Directory Domains And Trusts and select Operations Masters from the shortcut menu.
The Change Operations Master dialog box opens.
You can view the name of the existing Domain Naming Master in the Domain Naming Operations Master box.
Click Close.

How to view the existing RID Master role, PDC Emulator, and Infrastructure Master role assignments

Open the Active Directory Users And Computers console from the Administrative Tools menu.
In the console tree, right-click Active Directory Users And Computers and click All Tasks, and then Operations Masters from the shortcut menu.
The Operations Masters dialog box contains the following tabs:
- RID tab: The name of the existing RID Master is displayed in the Operations Master box of this tab.
- PDC tab: In the Operations Master box of the PDC tab, you can view the name of the existing PDC Emulator.
- Infrastructure tab: The existing Infrastructure Master's name is displayed in the Operations Master box.
Click Close.

How to transfer the Schema Master role to another domain controller

Before you can transfer the Schema Master role to another domain controller, ensure that you have the required Schema Admins rights, and that both domain controllers you are planning to work with are available. Before you can use the Active Directory Schema MMC snap-in, you first have to add it to a MMC.

To add the Active Directory Schema snap-in to a MMC,

Open a command prompt, and enter regsvr32 schmmgmt.dll to register the schmmgmt.dll on the computer.
Click Start, Run, and enter mmc in the Run dialog box. Click OK.
From the File menu, select Add/Remove Snap-in and then select Add.
In the list of available snap-ins, double-click Active Directory Schema.
Click Close. Click OK

To transfer the Schema Master role,

Open the Active Directory Schema snap-in.
Right-click Active Directory Schema in the console tree, and select Change Domain Controller from the shortcut menu.
The options available when the Change Domain Controller dialog box opens are
- Any DC: If this option is selected, Active Directory will select a new domain controller for the Schema Master role.
- Specify Name: If this option is enabled, you have to enter the name of the new location for the Schema Master Role.
Click OK
Right-click Active Directory Schema in the console tree again, and choose Operations Master from the shortcut menu.
When the Change Schema Master dialog box opens, click Change.
Click OK when a message appears prompting for verification of the OM role transfer you want to perform.
Click OK to exit the Change Schema Master dialog box.

How to transfer the Domain Naming Master role to another domain controller

You have to be a member of the Enterprise Admin group to transfer the Domain Naming Master role to another domain controller.

Open the Active Directory Domains And Trusts console from the Administrative Tools menu.
In the console tree, right-click Active Directory Domains And Trusts and select Connect To Domain Controller from the shortcut menu.
The Connect To Domain Controller dialog box opens. This is where you specify the name of the new domain controller that should be assigned the Domain Naming Master role.
Click OK
In the console tree, right-click Active Directory Domains And Trusts and select Operations Masters from the shortcut menu.
When the Change Operations Master dialog box opens, click Change
Click Close

How to transfer the RID Master role, PDC Emulator role, or Infrastructure Master role to another domain controller

Open the Active Directory Users And Computers console from the Administrative Tools menu.
In the console tree, right-click Active Directory Users And Computers and click Connect To Doman from the shortcut menu.
When the Connect To Domain dialog box opens, enter the domain name that you want to work with.
Click OK
In the console tree, right-click Active Directory Users And Computers and click Connect To Domain Controller from the shortcut menu.
When the Connect To Domain Controller dialog box opens, specify the new domain controller for the OM role that you are transferring.
Click OK
In the console tree, right-click Active Directory Users And Computers and click All Tasks, and then click Operations Masters from the shortcut menu.
The Operations Masters dialog box opens. On one of the following tabs,
- RID tab: Click Change to change the location of the RID Master
- PDC tab: Click Change to change the location of the PDC Emulator
- Infrastructure tab: Click Change to change the location of the Infrastructure Master.
Click Yes to verify that you want to transfer the particular OM role to a different domain controller.
Click OK. Click Close.

How to seize an Operations Master role

When you seize an OM role, you need to perform the following tasks:

Verify that the new domain controller for the role is completely updated with changes performed on the existing domain controller of the particular role. You can use the Replication Diagnostics command-line utility for this verification. Repadmin.exe is included with the Windows Support Tools on the Windows Server 2003 CD-ROM.
You would not use the Ntdsutil tool to seize the particular OM role. The Ntdsutil tool first attempts to transfer the role before it actually proceeds to seize the role.

However, if you need to seize the PDC Emulator or Infrastructure FSMOs, you can use the Active Directory Users and Computers console. The Ntdsutil tool has to though be used to seize the other FSMOs – Schema Master role, Domain Naming Master role, and RID Master role. You can however also use the Ntdsutil tool to seize the PDC Emulator role or Infrastructure Master role.

To seize the PDC Emulator or Infrastructure FSMOs using the Active Directory Users and Computers console,

Open the Active Directory Users and Computers console
In the console tree, right-click the domain object, and choose Connect to Domain Controller from the shortcut menu.
Enter the name of the other domain controller. Click OK
To perform the seizure of the role, right-click the domain object and choose Operations Masters from the shortcut menu.
Click either the PDC tab, or the Infrastructure tab
You will notice that the particular OM role is indicated as being offline.
Click Change.
Click OK to verify that you want to transfer the OM role.
Click Yes when prompted to verify that you want to perform a forced transfer.

To seize any OM roles using the Ntdsutil tool,

Click Start, Command Prompt.
Enter the following at the command prompt: ntdsutil. Press Enter
Enter the following at the ntdsutil prompt: roles. Press Enter
Enter the following at the fsmo maintenance prompt: connections. Press Enter
Enter the following at the server connections prompt: connect to server, and the fully qualified domain name (FQDN). Press Enter
Enter the following at the server connections prompt: quit. Press Enter.
Enter one of the following at the fsmo maintenance prompt:
- seize schema master. Press Enter
- seize domain naming master. Press Enter
- seize RID master. Press Enter
- seize PDC. Press Enter
- seize infrastructure master. Press Enter
Enter quit at the fsmo maintenance prompt. Press Enter
Enter quit at the ntdsutil prompt.

How to perorm a metadata cleanup

The class objects and attribute objects of the schema are referred to as metadata. A metadata cleanup is usually performed when you are unable to restore a failed domain controller. The cleanup removes any references to the failed domain controller in Active Directory.

To perform the metadata cleanup,

From the command prompt, enter ntdsutil and press Enter.
Enter the following at the ntdsutil prompt: metadata cleanup. Press Enter
Enter the following at the metadata cleanup prompt: connections. Press Enter
Enter the following at the server connections prompt: connect to server, followed by the server name. Press Enter
Enter quit, and press Enter
Enter the following at the metadata cleanup prompt: select operation target. Press Enter
Enter list domains. Press Enter
Enter select domain, followed by the number of the domain that holds the server that you want to remove. Press Enter
Enter list sites. Press Enter
Enter select site, followed by the number of the site that holds the server that you want to remove. Press Enter
Enter list servers in site. Press Enter
Enter select server, followed by the number of the server that you want to remove. Press Enter.
Enter quit and press Enter to return to the metadata cleanup prompt.
Enter remove selected server, and press Enter.
When a message box appears prompting you to verify whether the server should be removed, click Yes
Quit from Ntdsutil.