question

Nabeel-6224 avatar image
0 Votes"
Nabeel-6224 asked DonAbernathy-9539 answered

Transfer/Seize FSMO Roles

Hi,

I am asking this for Server 2012 R2

So in this article:
https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-fsmo-roles-in-ad-ds

If we want to seize FSMO roles of a failed DC, it says to first seize the FSMO roles by Ntdsutil utility, and then cleanup metadata of it by https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup#to-clean-up-server-metadata-by-using-ntdsutil

But in this second article of Metadata cleanup it says "Metadata cleanup also removes File Replication Service (FRS) and Distributed File System (DFS) Replication connections and attempts to transfer or seize any operations master (also known as flexible single master operations or FSMO) roles that the retired domain controller holds."

So that means I don't need to seize the FSMO roles by Ntdsutil utility first? I can directly use [Active Directory Users and Computers] to delete the failed DC and it will automatically [delete metadata] and transfer or seize FSMO roles?

windows-active-directorywindows-server-2012
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

FanFan-MSFT avatar image
0 Votes"
FanFan-MSFT answered Nabeel-6224 commented

Hi,

As the second article said , Metadata cleanup also attempts to transfer or seize any operations master (also known as flexible single master operations or FSMO) roles that the retired domain controller holds.
serveri is the rid holder in my lab. I shut it down and deleted it from the ADUC on DC1.

49142-12171.jpg
The fsmo role transferred to the dc1 in my lab.
49135-12172.jpg

But to be safely, i would recommend you size the role firstly and then do a metadata cleanup.


[2]: /answers/storage/attachments/48938-12172.jpg


12171.jpg (57.0 KiB)
12172.jpg (25.8 KiB)
12172.jpg (25.8 KiB)
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thanks.

In this case, if DC is deleted from ADUC, will it seize all 5 FSMO Roles? Or only the 3 Domain-wide FSMO roles?

Forest-Wide
Schema master
Domain naming master

Domain-Wide
RID master
PDC emulator
Infrastructure master

0 Votes 0 ·
DSPatrick avatar image
0 Votes"
DSPatrick answered

Before demotion you'll want to transfer the FSMO roles to another healthy domain controller. If demotion is successful then there is no need for cleanup. Metadata cleanup is more for the situation where a domain controller fails or cannot be demoted for some reason.
https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup
https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564

--please don't forget to Accept as answer if the reply is helpful--





5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Nabeel-6224 avatar image
0 Votes"
Nabeel-6224 answered

@FanFan-MSFT

Thanks.

In this case, if DC is deleted from ADUC, will it seize all 5 FSMO Roles? Or only the 3 Domain-wide FSMO roles?

Forest-Wide
Schema master
Domain naming master

Domain-Wide
RID master
PDC emulator
Infrastructure master

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thameur-BOURBITA avatar image
0 Votes"
Thameur-BOURBITA answered

Hi,

No, If you use metadata cleanup method to demote the domain controller with FSMO roles, you have to seize them manually .

transfer-or-seize-fsmo-roles-in-ad-ds




Please Don't forget to mark this reply as answer if it help you to fix your issue

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DonAbernathy-9539 avatar image
0 Votes"
DonAbernathy-9539 answered

after running commands for FSMO role captures this is the outcome. I can not take over PDC and Naming master roles.


C:\Users\act>netdom query fsmo
Schema master Servert340.domain.local
Domain naming master Server.domian.local
PDC Server.domain.local
RID pool manager Servert340.domain.local
Infrastructure master Servert340.domain.local

servert340 should have all roles..

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.