Transferring FSMO roles to a new DC

[Koldov]

Just spun up a VM and promoted to a DC and looking to transfer all the FSMO roles.

 

According to MS there are 5 roles:

 

Schema master

Domain naming master

PDC emulator

RID master

Infrastructure master

 

Further down the page it says the following:

 

"Do not put the Infrastructure master role on the same DC as the global catalog server."

 

'The' Global Catalog Server...?

 

I've checked and all my DCs are GCs... including the current FSMO holder...

[Davit2005]

I think it really depends on your setup i.e. if you have only 1 or 2 DCs and a single domain forest what is the point of having only one Global Catalog. I could be mistaken.

 

Last time I built DCs years ago I looked at the similar of FSMO placements.

 

https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/fsmo-placement-and-optimization-on-ad-dcs

 

Legacy guidance suggests placing the infrastructure master on a non-global catalog server. There are two rules to consider:

 

Single domain forest:

 

In a forest that contains a single Active Directory domain, there are no phantoms. So, the infrastructure master has no work to do. The infrastructure master may be placed on any domain controller in the domain, whether that domain controller hosts the global catalog or not.

 

Multidomain forest:

 

If every domain controller in a domain that's part of a multi-domain forest also hosts the global catalog, there are no phantoms or work for the infrastructure master to do. The infrastructure master may be put on any domain controller in that domain. Practically, most administrators host the global catalog on every domain controller in the forest.

 

If every domain controller in a given domain that's located in a multi-domain forest doesn't host the global catalog, the infrastructure master must be placed on a domain controller that doesn't host the global catalog.

Edited July 13, 2022 by Davit2005

[Koldov]

if you have only 1 or 2 DCs and a single domain forest what is the point of having only one Global Catalog.

 

Yes, that makes sense and describes our set-up.

 

"In a forest that contains a single Active Directory domain, there are no phantoms. So, the infrastructure master has no work to do. The infrastructure master may be placed on any domain controller in the domain, whether that domain controller hosts the global catalog or not."

 

So I'm going with the fact that it's OK. The MS article didn't explain why, just said don't do it... I guess it was written to encompass more complicated set-ups.

 

Right, I guess by now there's a one line PS script to get it all done... Anyone?

[jthompson]

Right, I guess by now there's a one line PS script to get it all done... Anyone?

 

Untested, but...

Move-ADDirectoryServerOperationMasterRole -Identity "Target-DC-Hostname" -OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMaster

 

This is based on https://docs.microsoft.com/en-us/powershell/module/activedirectory/move-addirectoryserveroperationmasterrole?view=windowsserver2019-ps

[Koldov]

Sounds great!

 

Not a fan of 'untested' though...

 

Maybe I should stay old school.

[jthompson]

When I last did that I was a wimp and waited until the middle of the summer holiday and used the GUI.

[Koldov]

I'm sitting on quite a few changes at the moment.... can't wait for them to leave!

 

Getting an itchy trigger finger to be honest, but I know I don't want the hassle of it all going wrong in the last week or so...

[jthompson]

Yep. Not so much 'move fast and break things' and 'move slowly and fix stuff'.

[Primus]

I'm sitting on quite a few changes at the moment.... can't wait for them to leave!

 

Getting an itchy trigger finger to be honest, but I know I don't want the hassle of it all going wrong in the last week or so...

 

We've got loads of stuff on this summer, so busy, but I also can't wait to get started, so impatient now!

[pete]

My list is usually.

 

1. Check AD is coherent and sane
   
2. Move role
   
3. Make sure it moved
   
4. Rinse, lather, repeat
   

 

then (assuming N+1 DCs) swap it over during the working day.