FSMO Owner

Question

Fsmo roles transfared from dc1 2008r2 to DC2 2016
when i run netdom query fsmo it shows all 5 roles in dc2.
but when i run

"dsquery * CN=Infrastructure,DC=DomainDnsZones,DC=mycompany,DC=com -attr fSMORoleOwner "

the result is

" fSMORoleOwner
CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mycompany,DC=com"

and when i ask for w32tm query source it answer the DC1 is the source where DC2 should be the pdc emulator holder.

please help me to fix this.

Answer 1

Sounds like you missed one
transfer pdc

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-fsmo-roles-in-ad-ds

also check that the Windows Time service is started and configured.

Some general info

• All domain members should use NT5DS domain time.
• Desktops and member servers sync with any domain controller.
• Domain controllers sync with PDC emulator (one per domain)
• PDC emulator in child domain can sync with any domain controller in parent domain.
• PDC emulator in parent domain syncs with either a hardware clock or possibly an external source.
  https://blogs.technet.microsoft.com/nepapfe/2013/03/01/its-simple-time-configuration-in-active-directory/

On PDC emulator
w32tm /unregister
net stop w32time
w32tm /register
net start w32time
w32tm /config /manualpeerlist:<external ntp address> /syncfromflags:manual /reliable:yes /update
net stop w32time
net start w32time
then check
w32tm /query /source
w32tm /query /configuration

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Hi,

Check the replication health between your domain controllers and the status of windows time service in each domain controller

As mentioned by Patrick , each domain controller will synchronize with the PDC in same domain. In case where you have a forest with multi child domain , the PDC of each child domain will synchronize with a domain controller in root domain.

Please don't forget to mark this reply as answer if it help you to fix your issue

Answer 3

Patrick
thanks for your response
i followed the steps you provided, and the time source now is DC2.
but the first part confused me, why fsmoRole Owner attribute in infrastructure properties still indicate to dc1 where it should be dc2.
CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mycompany,DC=com

Answer 4

@Bourbita
thanks for your response
the steps mentioned by Patrick was helpful.
and the replication completed with no error.

but the first part still confuses me.

i will appreciate any help.

Answer 5

Might also check the results below
dcdiag /v