{"id":1969,"date":"2014-12-15T22:58:39","date_gmt":"2014-12-15T18:58:39","guid":{"rendered":"https:\/\/rakhesh.com\/?p=1969"},"modified":"2014-12-21T17:53:56","modified_gmt":"2014-12-21T13:53:56","slug":"active-directory-operations-master-roles","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/windows\/active-directory-operations-master-roles\/","title":{"rendered":"Active Directory: Operations Master Roles"},"content":{"rendered":"

Active Directory is a multimaster<\/em> database. Which means it has no single master – any of the domain controllers (the read-write ones) can make changes to the Active Directory database. However, there are some tasks that necessarily need a single domain controller to be the one in charge. You can still make changes from any domain controller, but they will check with a select domain controller to ensure there’s no conflicts in making the change or perhaps ask this Domain Controller to actually make the change.<\/p>\n

There are five such tasks where Active Directory behaves as a singlemaster<\/em> database. For these tasks only a designated Domain Controller can update the database. Mind you, not all tasks need to be performed by the same Domain Controller. A Domain Controller that can carry out a particular task is one that holds the role to carry out that task. All five roles can be in a single Domain Controller, or they can be in separate Domain Controllers. Any Domain Controller holding a particular role is said to be the Flexible Single Master Operator<\/em> (FSMO) for that task.<\/p>\n

As you know a domain is part of a forest. A single forest can contain multiple domains. Two of these roles are held by a single Domain Controllers in the entire forest. Three of these roles are held by single Domain Controllers in the particular domain. Thus a forest with a single domain has 5 roles, while a forest with two domains has 8 roles (2 for the forest and 3×2 for each domain). The roles are automatically<\/em> assigned when the forest\/ domain is created. The first DC in the forest has the two forest roles assigned to it; the first DC in a domain has the three domain roles assigned to it. Administrators who have appropriate rights can then move these roles to other DCs.<\/p>\n

Forest-wide roles<\/h2>\n

These are roles held by a Domain Controller\/ Domain Controllers across all<\/em> domains in the forest. These roles can be on any<\/em> DCs in the forest, not necessarily the forest root domain.<\/p>\n

Schema Master<\/h3>\n

The DC holding the Schema Master role is the only one that can update the AD schema. The schema is Active Directory’s blueprint<\/a>. It is what defines the sort of objects the directory can contain and what attributes can be set for these objects. The schema is set at the forest level and shared by all domains in the forest. Administrators rarely need to update the schema except when installing programs that add new attributes to the objects. For instance, Exchange installs require a schema update as the objects now contain additional attributes such as the email address.<\/p>\n

The schema itself is stored in Active Directory in a separate partition and replicated to all DCs<\/a>. The schema partition is an instance of a dMD (Directory Management Domain) class object. All DCs in the forest thus have a copy of the schema and can read it, but only the DC holding the Schema Master role can write to it. This way there can be no conflicts if multiple DCs try and update the schema.<\/p>\n

The current version of the schema can be found using ADSI Edit, connect to the Schema context and check the objectVersion<\/code> attribute.<\/p>\n

\"objectVersion\"<\/a><\/p>\n

Via command-line the schema can be checked using repadmin \/showattr<\/code><\/a>:<\/p>\n

> repadmin \/showattr win-dc01 \"CN=Schema,CN=Configuration,DC=rakhesh,DC=local\" \/atts:objectVersion\r\nDN: CN=Schema,CN=Configuration,DC=rakhesh,DC=local\r\n    1> objectVersion: 69\r\n<\/pre>\n
Or PowerShell:<\/p>\n
PS> get-adobject (Get-ADRootDSE).schemaNamingContext -Property ObjectVersion\r\n\r\n\r\nDistinguishedName : CN=Schema,CN=Configuration,DC=rakhesh,DC=local\r\nName              : Schema\r\nObjectClass       : dMD\r\nObjectGUID        : 520b243c-0506-48f8-a5d1-e24253cfbd18\r\nObjectVersion     : 69<\/pre>\n
My domain is at the schema version of Windows Server 2012 R2<\/a>. If I were to install Exchange the schema version will change (each version of Exchange has its own schema version). When I extend the schema or run adprep \/forestprep<\/code> the DC with the Schema Master role is the one that’s responsible. In fact, the adprep \/forestprep<\/code> command must be run<\/a> on the DC with the Schema Master role. <\/p>\n
The “Change Schema Master” right<\/a> is required to transfer\/ seize the Schema Master role to a different DC. By default only the Schema Admins group members have this right.<\/p>\n
More about schema and how it works can be found in this TechNet article<\/a>.<\/p>\n
Domain Naming Master<\/h3>\n
Remember my post on DCDiag<\/a> where I introduced the Partitions container (CN=Partitions,CN=Configuration,DC=forestRootDomain<\/code>) in the Configuration NC? This container has objects of class crossRef<\/code> that are cross-references to all domain partitions\/ naming contexts in the forest. Well, the DC holding the Domain Naming Master is the only one that can make changes to this container – which means it is the only one that can add\/ remove\/ rename\/ move domains in the forest and authorize creation\/ deletion of application NCs. This way there’s one DC in the forest who is responsible for the forest-wide namespace. Conflicts are avoided as multiple DCs can not make changes here.\u00a0<\/p>\n
The “Change Domain Master” right<\/a> is required to transfer\/ seize the Domain Naming Master role to a different DC. By default only the Enterprise Admins group members have this right.<\/p>\n
Domain-wide roles<\/h2>\n
These are roles that are held by Domain Controllers in each<\/em> domain.<\/p>\n
PDC Emulator<\/h3>\n
The PDC Emulator – so named because it emulates a Primary Domain Controller (PDC) of Windows NT domains – has many functions:<\/p>\n