Do you need to transfer FSMO roles to another domain controller?
No problem, it is very is to do.
In this tutorial, I’ll show you step-by-step instructions to transfer the FSMO roles from one domain controller to another. I’ll show you two methods: the first is using PowerShell and the second is using the ADUC GUI.
Why Transfer FSMO roles?
By default, when Active Directory is installed all five FSMO roles are assigned to the first domain controller in the forest root domain. Transferring FSMO roles is often needed for several reasons including:
- Upgrading the operating system
- Changing IP addresses on a domain controller
- Demoting a domain controller
- Taking a domain controller offline for maintenance
- Performance issues
It is recommended to only transfer FSMO roles when the current role holder is operational and is accessible on the network. For a complete list of considerations see the MS article Transfer or seize FSMO Roles in Active Directory Services.
Step 1: List Current FSMO Role Holders
Before moving the FSMO roles it is a good idea to check which domain controllers hold which roles.
You can list which domain controllers hold FSMO roles with these two PowerShell commands:
Get domain level FSMO roles
get-addomain | select InfrastructureMaster, PDCEmulator, RIDMaster
Get forest level FSMO roles
Get-ADForest | select DomainNamingMaster, SchemaMaster
Below is a screenshot of the results in my domain.
List of installed roles in my domain:
- InfrastructureMaster is on DC1
- PDCEmulator is on DC2
- RIDMaster is on DC2
- DomainNamingMaster is on DC1
- Schemamaster is on DC1
I want to move all the roles from DC2 to DC1, I’ll demonstrate this below.
Step 2: Transfer FSMO Roles
I’ll first demonstrate transferring roles with PowerShell, it is by far the easier option of the two (in my opinion).
You want to log into the server that you will be transferring the roles to, in my case it is DC1.
To move a role with PowerShell you will use the Move-ADDirectoryServerOperationMasterRole cmdlet, then the hostname of the server to transfer to.
Transfer PDCEmulator
Move-ADDirectoryServerOperationMasterRole -Identity "dc1" PDCEmulator
Transfer RIDMaster
Move-ADDirectoryServerOperationMasterRole -Identity "dc1" RIDMaster
Transfer InfrastrctureMaster
Move-ADDirectoryServerOperationMasterRole -Identity "dc1" Infrastructuremaster
Transfer DomainNamingMaster
Move-ADDirectoryServerOperationMasterRole -Identity "dc1" DomainNamingmaster
Transfer SchemaMaster
Move-ADDirectoryServerOperationMasterRole -Identity "dc1" SchemaMaster
Here is a screenshot of when I moved PDCEmulator and RIDMaster to DC1.
Now if I re-run the commands to list the FSMO roles I should see them all on DC1.
Yes, I have confirmed all the roles are now on DC1. As you can see moving FSMO roles with PowerShell is very easy to do.
Now let’s see how to transfer FSMO roles using the Active Directory Users and Computers GUI.
Transfer FSMO Roles Using ADUC GUI
Just like PowerShell you need to log into the server that you will be transferring to. I’m transferring from DC2 to DC1 so I’ll log into DC1.
Open the Active Directory Users and Computers console, then right-click on the domain and click on operations masters.
You should now see a screen with three tabs (RID, PDC, and Infrastructure).
To transfer one of these roles just click on the change button. You can’t select which domain controller to transfer the role to, that is why you need to log into the server that you want to transfer to. if I wanted to transfer the RID role to DC3 I would log into that server.
To transfer the domain naming operations master role you will need to open Active Directory Domains and Trusts. Right-click on “Active Directory Domains and Trusts” and select “Operations Master”.
Now click change to transfer the role to another DC.
To transfer the schema master role follow these steps.
Open a command line and run the command regsvr32 schmmgmt.dll
Next, you need to open an MMC console. To do this click on start then type mmc. and click the icon.
Next, click File, then Add/Remove Snap-in
Add “Active Directory Schema” from the list and click ok.
Right click on “Active Directory Schema” and change the domain controller to the server you want to transfer the role to.
In this example, I’ll change the domain controller to DC2.
Now you can right-click on Active Directory schema and select “Operations Master” to transfer the schema master role.
Confirm the role is changing to the correct DC and click the “change” button.
As you can see transferring FSMO roles with the GUI takes a lot of extra steps and that is why I prefer to use PowerShell. But if you are not into Powershell then the GUI works just fine.
Summary
Moving FSMO roles to another server is not a daily task but is necessary at times. Microsoft recommends the server be online when moving roles. The steps in this tutorial should help you when it comes time to move roles.
Source :
https://activedirectorypro.com/transfer-fsmo-roles/