FSMO

1. FSMO
Flexibility Schema Operations
Master

2. FSMO
There are five roles in FSMO and it is further
divide in two categories.
• Forest Roles
• Domain Roles

3. Forest Roles
• Schema Master - As name suggests, the changes that
are made while creation of any object in AD or changes
in attributes will be made by single domain controller
and then it will be replicated to another domain
controllers that are present in your environment. There
is no corruption of AD schema if all the domain
controllers try to make changes. This is one of the very
important roles in FSMO roles infrastructure.
• Domain Naming Master - This role is not used very
often, only when you add/remove any domain
controllers. This role ensures that there is a unique
name of domain controllers in environment.

4. Domain Roles
• Infrastructure Master - This role checks domain
for changes to any objects. If any changes are
found then it will replicate to another domain
controller.
• RID Master - This role is responsible for making
sure each security principle has a different
identifier.
• PDC emulator - This role is responsible for
Account policies such as client password changes
and time synchronization in the domain

5. Where these roles are configured?
• Domain wide roles are configured in Active Directory
users and computers. Right click and select domain and
here option is operations master.
• Forest roles Domain Naming master is configured in
active directory domain and trust right click and select
operations master. It will let you know the roles.
• Forest roles Schema Master is not accessible from any
tool as they want to prevent this. Editing schema can
create serious problem in active directory
environment. To gain access you need to create snap-in
and register dll file by regsvr32 schmmgmt.dll.

6. Seizing of Roles
• For Schema Master:
• Go to cmd prompt and type ntdsutil
• Ntdsutil: prompt type roles to enter fsmo maintenance.
• Fsmo maintenance: prompt type connections to enter server
connections.
• Server connections: prompt, type connect to server domain
controller, where
Domain controller is the name of the domain controller to which
you are going to transfer the role
• Server connections: prompt, type quit to enter fsmo maintenance.
• Fsmo maintenance: prompt, type seize schema master.
• After you have Seize the role, type quit to exit NTDSUtil.

7. For Domain Naming Master:
• Go to cmd prompt and type ntdsutil
• Ntdsutil: prompt type roles to enter fsmo maintenance.
• Fsmo maintenance: prompt type connections to enter
server connections.
• Server connections: prompt, type connect to server
domain controller, where
Domain controller is the name of the domain controller to
which you are going to transfer the role
• Server connections: prompt, type quit to enter fsmo
maintenance.
• Fsmo maintenance: prompt, type seize domain naming
master.
• After you have Seize the role, type quit to exit NTDSUtil.

8. For Infrastructure Master Role:
• Go to cmd prompt and type ntdsutil
• Ntdsutil: prompt type roles to enter fsmo maintenance.
• Fsmo maintenance: prompt type connections to enter
server connections.
• Server connections: prompt, type connect to server
domain controller, where
Domain controller is the name of the domain controller to
which you are going to transfer the role
• Server connections: prompt, type quit to enter fsmo
maintenance.
• Fsmo maintenance: prompt, type seize infrastructure
master.
• After you have Seize the role, type quit to exit NTDSUtil.

9. For RID Master Role:
• Go to cmd prompt and type ntdsutil
• Ntdsutil: prompt type roles to enter fsmo maintenance.
• Fsmo maintenance: prompt type connections to enter
server connections.
• Server connections: prompt, type connect to server domain
controller, where
Domain controller is the name of the domain controller to
which you are going to transfer the role
• Server connections: prompt, type quit to enter fsmo
maintenance.
• Fsmo maintenance: prompt, type seize RID master.
• After you have Seize the role, type quit to exit NTDSUtil.

10. For PDC Emulator Role:
• Go to cmd prompt and type ntdsutil
• Ntdsutil: prompt type roles to enter fsmo maintenance.
• Fsmo maintenance: prompt type connections to enter
server connections.
• Server connections: prompt, type connect to server domain
controller, where
Domain controller is the name of the domain controller to
which you are going to transfer the role
• Server connections: prompt, type quit to enter fsmo
maintenance.
• Fsmo maintenance: prompt, type seize PDC.
• After you have Seize the role, type quit to exit NTDSUtil.