Seizing FSMO roles with PowerShell

 

I wrote some time ago an article about Seizing FSMO roles. That was a little bit painful method and it required to use ntdsutil command which is inconvenient in use. Especially for unexperienced administrators.

Now, when Microsoft released PowerShell 3.0 with Windows 8 Remote Server Adminisration Tools and Windows Server 2012 we have new Active Directory module for PowerShell. It allows to use dedicated PowerShell cmd-let for that.

When your Domain Controller holding any FSMO role is down and cannot be brought up again you need to seize that/there role(s) to the new one.

You would be able to use PowerShell cmd-let

Move-ADDirectoryServerOperationMasterRole

Hey, this exactly the same cmd-let as for transferring FSMO roles, am I right? Yes, you are. The only one difference is that you have to specify at the end of the cmd-let -Force switch which tells that role must be seized not transferred!

Of course to be able to use this feature some prerequisites are required:

  • At least one Windows Server 2008R2 Domain Controller
  • Access to Active Directory Web Services (9389/tcp port unblocked)
  • Server or client machine with PowerShell 3.0 or newer
  • Imported PowerShell 2.0  or newer module for Active Directory

 To get an overview of this command let’s see its help by typing

Get-Help Move-ADDirectoryServerOperationsMasterRole
Move-ADDirectoryServerOperationMasterRole help

Move-ADDirectoryServerOperationMasterRole help

In this case 3 parameters are required:

  • target Domain Controller name
  • FSMO role(s) name to seize
  • -Force switch

Important! When you are seizing any FSMO role, you need to know that Domain Controller which held this role previously, cannot be brought up on-line! This machine may be reused, but first it must be reinstalled!

To get an overview of transferring FSMO roles with PowerShell please read an article on my blog showing how to do that. The article is available at this link.

You are allowed to seize one specific FSMO role or set of FSMO roles. This can be done once as this operation requires old Domain Controlller reinstallation. please be aware of that, there is no place for mistake! 🙂

Seizing specific FSMO role

Active Directory contains five unique FSMO roles:

  • Schema Master
  • Domain Naming Master
  • PDC Emulator Master
  • RID Master
  • Infrastructure Master

if any of these roles where held by your broken Domain Controller, you need to seize it to the new one. Just do this like you would be transferring them but at the end of cmd-let place -Force switch

Move-ADDirectoryServerOperationMasterRole -Identity <TargetDomainController> -OperationMasterRole <FSMORoleName> -Force

this will seize specified operation master role to selected Domain Controller. It would take some time as cmd-let tries to connect to the previous DC and check if there is possible role transfer instead of seize.

Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole InfrastructureMaster -Force

 Seizing specified FSMO role

Seizing specified FSMO role

to seize other role than this one, replace its name with  one of those below

  • SchemaMaster
  • DomainNamingMaster
  • PDCEmulator
  • RIDMaster
  • InfrastructureMaster

Information! When you transfer PDC Emulator role, you need to remember that you should introduce new time server within your environment. If you wish, you may follow steps described in the article on my blog at Advertising new time server in domain environment

and remember, when you are seizing any FSMO role, you need to know that Domain Controller which held this role previously, cannot be brought up on-line! This machine may be reused, but first it must be reinstalled!

Seizing set of FSMO roles

This works exactly the same way as for transferring FSMO roles. You just need to specify operation master role name(s) separated by comma (,) and put -Force switch at the end. All provided FSMO roles will be seized to the selected Domain Controller.

To seize roles use below syntax

Move-ADDirectoryServerOperationMasterRole -Identity <TargetDomainControllerName> -OperationMasterRole <FSMORoleName1>, <FSMORoleName2>, ...<FSMORoleNameN> -Force

and these operation master roles will be seized.

Commonly used scenarios are related with seizing forest-wide, domain-wide or all FSMO roles. Let’s see  how to do that

Seizing forest-wide FSMO roles:

Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole SchemaMaster, DomainNamingMaster -Force

Seizing domain-wide FSMO roles:

Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole PDCEmulator, RIDMaster, InfrastructureMaster -Force

Seizing all FSMO roles:

Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster -Force
Seizing all FSMO roles

Seizing all FSMO roles

It would take some time as cmd-let tries to connect to the previous DC and check if there is possible roles transfer instead of seize.

Information! When you transfer PDC Emulator role, you need to remember that you should introduce new time server within your environment. If you wish, you may follow steps described in the article on my blog at Advertising new time server in domain environment

and remember, when you are seizing any FSMO role, you need to know that Domain Controller which held this role previously, cannot be brought up on-line! This machine may be reused, but first it must be reinstalled!

To verify if operation master roles were seized to selected Domain Controller, execute

for forest-wide FSMO roles:

Get-ADForest | Select SchemaMaster, DomainNamingMaster | Format-List
Veryfying forest-wide FSMO roles

Veryfying forest-wide FSMO roles

and for domain-wide FSMO roles use this one:

Get-ADDomain | Select PDCEmulator, RIDMaster, InfrastructureMaster | Format-List
Veryfying domain-wide FSMO roles

Veryfying domain-wide FSMO roles

At the end, you should do metadata cleanup for that broken Domain Contoller, and that’s all!

If you wish you may follow other articles on my blog, showing how to do metadata cleanup of broken Domain Controller

Author: Krzysztof Pytko

Facebooktwittergoogle_plusredditpinterestlinkedinmail

Leave a Reply

Your email address will not be published. Required fields are marked *