What is FSMO Roles (Flexible Single Master Operations)

What is Flexible Single Master Operations (FSMO roles)

It is one of the best interview question that Interviewers ask in the interviews. After reading this article you can answer the question i.e. “What is FSMO Roles“. Flexible Single Master Operation (FSMO Roles) is a feature of Microsoft’s Active Directory. Now the question arises, What FSMO roles do? FSMO roles avoid the conflicting of operations between the multiple Domain Controllers.

FSMO roles are of five types. Domain Naming Master, Schema Master, Primary Domain Controller (PDC), Relative Identifier Master (RID master) and Infrastructure Master. By default, all five FSMO roles are assigned to the first DC created in the forest. However, you can transfer or distribute them to other DC.

Forest-wide FSMO Roles

Schema Master Role (SM)

Since, schema master is forest-wide role it means there will be only one DC having schema master in a forest. It contains all the information about the attributes and classes of the forest. DC having Schema master should be online while modifying the schema. It is advised that we should not modify schema unless and until it is very essential. Schema modifies automatically when we install Exchange Server.

Domain Naming Master Role (DNM)

It is also a forest wide role which means that by default the first Domain Controller of the forest has Domain Naming Master. This FSMO role is required while adding a new domain in a forest or while removing an existing domain from a forest. The DC having DNM should be online while performing these operations. Don’t get confused between adding or removing domain in/from a forest and promoting or demoting a DC in  a domain. Domain Naming Master is not required while performing promotion or demotion of an Additional Domain Controller.

Domain-wide FSMO roles are

PDC

Primary domain controller (PDC) is a domain-wide FSMO role which means first Domain Controller of each domain of a forest have this role. PDC is required to sync time between all the DCs and also between Domain Controller and other computers of a domain. It also records all the password changes from client computers and replicate/update to all the DCs throughout the domain. It is one of the most important roles because of its time sync feature, it should be online 24×7. Domain users would not login to member servers or client computers if PDC FSMO Role is not available.

RID Master Role 

All objects in a domain have unique ID known as RID. Relative Identifier Master role (RID role) provides the pool of RID’s to each of the Domain Controllers in a domain. When a DC creates a user, group, or computer object, a unique RID is assigned to each object. If DC having the RID is not available then none of the DC is able to renew its RID pool. The RID master provides a pool of 500 unique RIDs to each DC and renews their pools when 250 unique IDs remains left. DC can create about 500 objects even if the RID FSMO Role is not available.

Infrastructure Master Role

Infrastructure Master provides all the group membership updates from one domain to another domain. This FSMO role is not required in an environment is of single domain. Infrastructure role is required in the environment of a forest having multiple domains. It is advised not to have Global Catalog and Infrastructure  on the same Domain Controller because it have partial information of other domain and therefore, it doesn’t allow full updates of other domains.

Steps to transfer FSMO roles  through command prompt in Windows Server 2012 R2

1. Consider a scenario of two DCs. Here, we have two Domain Controller i.e. DC01 and DC02 in a forest. In this post, we are transferring FSMO roles from DC01 to DC02 using command prompt.

active-directory-group-policy-2012-lab
Share this post:

Leave a Reply

Your email address will not be published. Required fields are marked *