WHICH FSMO ROLE IS THE MOST IMPORTANT

I am reading MS Tec-net discussing group and following up some post, in regards to a problem, and second person who is trying to help is writing back

"The PDCEmulator role is the more or less old PDC from NT4, but only used for backwards compatibility"

This statement above made me write this article. The question is, What FSMO role is the most important or less important always been asked to me in each MCSE class

Beside the function of emulating the PDC (Primary Domain Controller) for NT4 clients in the domain, below is the list what PDC Emulator does.

PDC Emulator

• Synchronizes time over the domain, ensuring all clients have the same time - which is required for kerberos authentication (logons) to work properly.
  
• Manages password changes made in the domain
  
• Incorrect logons are forwarded to the PDC before the error is shown to the user - to check the password is in fact incorrect
  
• Account lockouts are processed on the PDC emulator
  
• Group policy management is always made on the PDC emulator, unless specified by the administrator
  
• People will notice its downtime rather quickly ( missing PDC will generate tons of call to your help desk, trust me on this)
  
• Usually the first one to be noticed if missing will be the PDC Emulator (due to its role as Domain Master Browser really in a multi-subnet network.)
  

In a single domain environment, the others might not be as important as PDC or I would say so quick or noticeable as an negative impact to your environment

Missing DNS master

If you were adding Domains the absence of Domain Naming Master , will be the problem, since the operation will fail.

Missing Schema master

If an application needs to make changes to the Schema and cannot contact to schema master you will have problems. For instance installing exchange will extend the schema, so you won't be able to install exchange, and this is end of the world to me (-:, hey when it comes to Exchange I should not be needing to list any other reason here why you and me would need Schema master to be here, when we want to install exchange server. (-:

Missing RID master

The RID master is the one most people would notice either first or right after the PDC Emulator since after adding about 500 users (security principals really) to a single DC you would run out of RIDs. If you are not adding 500 users per day (-: you don't have to worry about this role for today.

Missing Infrastructure master

This is another domain-specific role and its purpose is to ensure that cross-domain object references are correctly handled.

Conclusion:

Despite the name of PDC, and not having any NT 4.0 in the environment does not make the PDC emulator the less important role? In fact this is the most heavily used FSMO role and it is also the most important FSMO role (quick side effects). All FSMO roles are important, but the Missing PDC is going to give you the quickest headache you would ever wanted on monday early morning. Who is your PDC (-:

Regards,

Oz Ozugurlu

Systems Engineer

MCITP (EMA), MCITP (SA),

MCSE 2003 M+ S+ MCDST

Security Project+ Server+

oz@SMTp25.org

http://smtp25.blogspot.com

Recommendations for FSMO Role Placement

I have recently posted some guidelines showing the best placement for distributing FSMO roles. Below article is straight taken from TechNet and it has great information. I am posting it as it is here in my blog..Although you can assign the operations master roles to any domain controller, follow these guidelines to minimize administrative overhead and ensure the performance of Active Directory. If a domain controller that is hosting operations master roles fails, following these guidelines also simplifies the recovery process. Guidelines for role placement include:

• Leave the two forest-level roles on a domain controller in the forest root domain.
  
• Place the three domain-level roles on the same domain controller.
  
• Do not place the domain-level roles on a global catalog server.
  
• Place the domain-level roles on a higher performance domain controller.
  
• Adjust the workload of the operations master role holder, if necessary.
  

Choose an additional domain controller as the standby operations master for the forest-level roles and choose an additional domain controller as the standby for the domain-level roles.

Requirements for Infrastructure Master Placement

• Do not place the infrastructure master on a domain controller that is also a global catalog server.
  

The infrastructure master updates the names of security principals for any domain-named linked attributes. For example, if a user from one domain is a member of a group in a second domain and the users name is changed in the first domain, then the second domain is not notified that the users name must be updated in the groups membership list. Because domain controllers in one domain do not replicate security principals to domain controllers in another domain, the second domain never becomes aware of the change. The infrastructure master constantly monitors group memberships, looking for security principals from other domains. If it finds one, it checks with the security principals domain to verify that the information is updated. If the information is out of date, the infrastructure master performs the update and then replicates the change to the other domain controllers in its domain.

Two exceptions apply to this rule.

First, if all the domain controllers are global catalog servers, the domain controller that hosts the infrastructure master role is insignificant because global catalogs do replicate the updated information regardless of the domain to which they belong. Second, if the forest has only one domain, the domain controller that hosts the infrastructure master role is not needed because security principals from other domains do not exist.

Guidelines for Role Placement

By improperly placing operations master role holders, you might prevent clients from changing their passwords or being able to add domains and new objects, such as Users and Groups. You might also be unable to make changes to the schema. In addition, name changes might not properly appear within group memberships that are displayed in the user interface.

As your environment changes, you must avoid the problems associated with improperly placed operations master role holders. Eventually, you might need to reassign the roles to other domain controllers.

Although you can assign the forest-level and domain-level operations master roles to any domain controller in the forest and domain respectively, improperly placing the infrastructure master role can cause it to function improperly. Other improper configurations can increase administrative overhead.

Forest-level Role placement in the Forest Root Domain

• The first domain controller created in the forest is assigned the schema master and domain naming master roles. To ease administration and backup and restore procedures, leave these roles on the original forest root domain controller. Moving the roles to other domain controllers does not improve performance. Separating the roles creates additional administrative overhead when you must identify the standby operations masters and when you implement a backup and restore policy.
  
• Unlike the PDC emulator role, forest-level roles rarely place a significant burden on the domain controller. Keep these roles together to provide easy, predictable management.
  

Domain-level Role Placement on the Same Domain Controller

• The three domain-level roles are assigned to the first domain controller created in a new domain. Except for the forest root domain, leave the roles at that location. Keep the roles together unless the workload on your operations master justifies the additional management burden of separating the roles.
  
• Because all clients prior to Active Directory submit updates to the PDC emulator, the domain controller holding that role uses a higher number of RIDs. Place the PDC emulator and RID master roles on the same domain controller so that these two roles interact more efficiently.
  
• If you must separate the roles, you can still use a single standby operations master for all three roles. However, you must ensure that the standby is a replication partner of all three of the role holders.
  
• Backup and restore procedures also become more complex if you separate the roles. Special care must be taken to restore a domain controller that hosted an operations master role. By hosting the roles on a single computer, you minimize the steps that are required to restore a role holder.
  

Domain-level Role Placement on a Higher Performance Domain Controller

Host the PDC emulator role on a powerful and reliable domain controller to ensure that it is available and capable of handling the workload. Of all the operations master roles, the PDC emulator creates the most overhead on the server that is hosting the role. It has the most intensive daily interaction with other systems on the network. The PDC emulator has the greatest potential to affect daily operations of the

TechNet

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com

FSMO ROLES AND BEST PRACTICES

FSMO roles always been one of the hottest subject in pretty much in any interview and the functionality is curtail for any network administrator to understand. Before we even mentioned about FSMO roles, let's ask these questions and try to understand the concept and see the need for FSMO roles (Operation Masters)Single master replication model, compare to multi master replication model. In single master replication model the active directory .DIT databases is read and write for the PDC (Primary domain Controller). The BDC (Backup domain controller) has only read copy of .DIT database (Active directory data base)

Now MultiMate replication model is, all domain controllers have read and write copy of the .DIT database. Client can register its own records to any available DC/GC in multi-master replication model. So obviously there is redundancy available to the clients. If you remember the concept of DNS and its integration with AD (Active directory).Multi master replication model is good. However some certain task still needed to be handled by specific DC's, therefore the Operations Masters (FSMO) was born.

First DC called sometimes root DC will inherit all FSMO roles.

Forest Wide

• DNS (Domain naming master)
  
• Schema Master
  

Domain Wide

• PDC Emulator
  
• RID master
  
• Infrastructure master
  

Now, if we have 12 domains how many FSMO roles we have (Consider one forest). The answers is going to be 38FSMO roles, 36 (each domain) + two of the forest wide roles.

Now we have following DC's and we will distribute the FSMO roles.

• DC1.smtp25.org
  
• DC2.smtp25.org
  
• DC3.smtp25.org
  
• DC4.smtp25.org
  
• DC5.smtp25.org
  

FQDN Server	ROLE
FOREST FSMO
DC1.smtp25.org	Schema Master	GC	Keep Schema master and Domain naming master on the same DC (easy administration). We could keep them separate as well; I don't see a reason doing it. We will make sure the DC has both roles is a Global catalog server as well.
DC1.smtp25.org	DNS Master	GC
DOMAINFSMO
DC2.smtp25.org	PDC	offload the GC	PDC Emulator and RID Master are being kept on the same domain controller. We need to offload the GC role from this domain controller, (GC are being used heavily)
DC2.smtp25.org	RID	offload the GC
DC3.smtp25.org	Inf Master		Note: Infrastructure Master Role can be held by a domain controller hosting the Global Catalog in two circumstances: when there is only one domain in your forest or when every single domain controller in your forest also hosts the Global Catalog.

Best,

Oz ozugurlu

Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com (Blog)

FSMO ROLES & How to seize them

We talked a lot about FSMO roles and their purpose on previous articles in my blog. The FSMO roles, I used to ask this question all the times

Which FSMO role is the most important considering one single domain / Forest. Or the opposite one, which FSMO role is the less important one considering one domain.

Answer of course will vary from person to another. The reality is that PDC emulator is the mostly, heavy used FSMO roles among others.

Another FSMO question is how to see FSMO roles? Those of you who have hands on experience will know ADUC is the first place to go and look for Domain wide FSMO roles

When a right clicks on ADUC and select Operations masters

• RID
  
• PDC
  
• Infrastructure
  

Seizing is kid stuff, fist connect to DC you wish to transfer these roles too, by opening ADUC and choosing connect to domain controller. Once you connect to the domain controller now open up the operation masters and start seizing them one by one

The forest ones requires same type of afford, only schema master needs a DLL file to be registered

Register Schmmgmt.dll

Go to command line or run menu copy or paste below and hit enter

regsvr32 schmmgmt.dll

Now we will seize the domain wide FSMO roles

Click start, run, and mmc, add snap in and select Active directory Schema snap in and select Active directory domains and trust snap in, click ok.

Same technique will apply here, first make a right click all the way top and select connect to domain controller ( this is the DC you are trying to transfer the FSMO role too) , once you connect to selected DC all you need to do is , another right click and "Operations Masters) and click change

Same applies for the Domain Naming Master Role.

Now, how to see all the FSMO roles one at the time is the question. Several different ways, including GUI and third party tools available to achieve this mission.

The easiest one I can think of would be Download support tools, and install it. Go to CMD and type following command

Netdom query fsmo

C:\>netdom query fsmo Schema owner vdc1.nwtraders.msft Domain role owner vdc1.nwtraders.msft PDC role vdc1.nwtraders.msft RID pool manager vdc1.nwtraders.msft Infrastructure owner vdc1.nwtraders.msft The command completed successfully.

Seize FSMO roles from command line

Schema master Domain naming master RID master PDC Infrastructure master

Forest wide and one per forest. Forest wide and one per forest. Domain specific and one for each domain. PDC Emulator is domain specific and one for each domain. Domain specific and one for each domain.

• Log on the DC open CMD
  
• Type following
  
• Ntdsutil, hit enter
  
• Roles ( you can use ? to see the available commands)
  
• Fsmo maintenance
  
• Connections
  
• Connect to server <Server name goes here>
  
• q
  
• Seize domain naming master
  

A windows will open up and will ask you sure you want to do this , click yes

All roles can be seized as below table

Seize domain naming master Seize infrastructure master Seize PDC Seize RID master Seize schema master

Each time you will get the same warning

Best,

Oz ozugurlu

MCITP (EMA) ,MCITP(SA),

MCSE (M+,S+) MCDST

Security+, Server +,Project+

FSMO ROLES

One of the most asked interview question is the FSMO roles. I remember in ach interview I walk into last coupe year I have asked every single time the FSMO roles. Operation masters no doughty is very important and curtail for every MCSE to understand and use it whenever is needed. I have already blogged about FSMO roles, why we needed them and how to keep memorize this role. I most offend ask to my students following question about FSMO roles.

If you have 12 Domain, and considering one Forest how many FSMO roles in total exist? I get multiple answers including 1 and 12 domains. Of course those of you understand would say 38 domains without thinking a second. Knowing FSMO roles are very important, indentifying these roles in AD (Active directory) is fairly easy. The Domain wide FSMO roles can be easily seen from ADUC (active directory users and computer, which are

• RID
  
• PDC
  
• Infrastructure
  

The Forest ones can be seen with multiple utilities, such as NetDom

C:\>netdom query fsmo

Schema owner nhqdtcdc1.ri.SMTP25.org

Domain role owner nhqdtcdc1.ri.SMTP25.org

PDC role nhqdtcdc4.archq.ri.SMTP25.org

RID pool manager nhqdtcdc4.archq.ri.SMTP25.org

Infrastructure owner nhqdtcdc3.archq.ri.SMTP25.org

The command completed successfully.

Other command question I have seen is related the AD maintenance

Ntdsutil

Authoritative restore	Authoritatively restore the DIT database
Configurable Settings	Manage configurable settings
Domain management	Prepare for new domain creation
Files	Manage NTDS database files
Help	Show this help information
LDAP policies	Manage LDAP protocol policies
Metadata cleanup	Clean up objects of decommissioned servers
Popups %s	(en/dis)able popups with "on" or "off"
Quit	Quit the utility
Roles	Manage NTDS role owner tokens
Security account management	Manage Security Account Database	Duplicate SID Cleanup
Semantic database analysis	Semantic Checker
Set DSRM Password	Reset directory service restore mode administrator account password

• Ntdsutil.exe is a command-line tool that provides management facilities for Active Directory.
  
• Seize FSMO roles using Ntdsutil.exe
  
• The partition for each FSMO role is in the following list:
  

FSMO role	Partition
Schema	CN=Schema,CN=configuration,DC=<forest root domain>
Domain Naming Master	CN=configuration,DC=<forest root domain>
PDC	DC=<domain>
RID	DC=<domain>
Infrastructure	DC=<domain>

Directory Services Restore Mode
Regards
Oz ozugurlu

Domain-level role absence on a Global Catalog server

Here is great information straight from TechNet, explaining why Infrastructure master should not be hosts as global catalog server on the same Domain Controller.

Do not host the infrastructure master on a domain controller that is acting as a global catalog server. The infrastructure master updates the names of security principals for any domain-named linked attributes.

For example:

If a user from one domain is a member of a group in a second domain and the user's name is changed in the first domain, then the second domain is not notified that the user's name must be updated in the group's membership list.

Because domain controllers in one domain do not replicate security principals to domain controllers in another domain, the second domain never becomes aware of the change. The infrastructure master constantly monitors group memberships, looking for security principals from other domains. If it finds one, it checks with the security principal's domain to verify that the information is updated. If the information is out of date, the infrastructure master performs the update and then replicates the change to the other domain controllers in its domain.

Two exceptions apply to this rule.

First:

If all the domain controllers are global catalog servers, the domain controller that hosts the infrastructure master role is insignificant because global catalogs do replicate the updated information regardless of the domain to which they belong.

Second:

If the forest has only one domain, the domain controller that hosts the infrastructure master role is not needed because security principals from other domains do not exist, because it is best to keep the three domain-level roles together, avoid putting any of them on a global catalog server.

TechNet

Best,

Oz ozugurlu