How To Find FSMO Roles Holders In Active Directory

The process of checking FSMO (Flexible Single Master Operations) roles in Active Directory remains consistent across Windows Server versions 2012, 2016, 2019, and 2022. After installing Active Directory Domain Services on a Windows Server within your environment, the FSMO roles are automatically assigned to that server. Whether dealing with multiple Domain Controllers or multiple domains within the forest, determining which Domain Controller holds specific FSMO roles becomes crucial.

FSMO roles refer to a set of operations that require a single authoritative source to prevent conflicts and ensure proper functioning of the Active Directory domain or forest. These roles are crucial for maintaining the integrity and consistency of the directory service.

There are five FSMO roles, and each has specific responsibilities:

1. Schema Master:
   • Responsible for making changes to the Active Directory schema. There is only one Schema Master per forest.
2. Domain Naming Master:
   • Manages the addition or removal of domains in the forest. Like the Schema Master, there is only one Domain Naming Master per forest.
3. RID Master (Relative Identifier Master):
   • Allocates unique RIDs (Relative Identifiers) to each domain controller within a domain. This ensures that every security principal (user, group, computer) in the domain has a unique identifier.
4. PDC Emulator (Primary Domain Controller Emulator):
   • Handles legacy tasks related to earlier versions of Windows, such as time synchronization within the domain, password changes, and user authentication for clients using NTLM.
5. Infrastructure Master:
   • Maintains references to objects in other domains. It ensures that cross-domain object references are kept up to date.

It’s important to note that while the Schema Master and Domain Naming Master roles are unique to the entire forest, the RID Master, PDC Emulator, and Infrastructure Master roles are present in each domain within the forest.

Proper management of FSMO roles is crucial for the stability and functionality of an Active Directory environment. Understanding these roles is essential for administrators responsible for maintaining and troubleshooting Active Directory infrastructure. If a domain controller holding an FSMO role fails, it’s important to transfer the role to another domain controller to prevent disruptions in the Active Directory environment.

This article guides you through the steps to check FSMO roles in Active Directory, ensuring a uniform approach across Windows Server versions 2012, 2016, 2019, and 2022.

 

Methods for Finding FSMO Roles Holder in Active Directory:

1. Command prompt
2. PowerShell
3. GUI ( Graphical Users Interface )

 

1. Command Prompt:

Netdom is a command-line utility designed for the administration of Windows domains and the management of trust relationships within Active Directory. To obtain a list of FSMO roles in an Active Directory, you can utilize the command as illustrated below:
netdom query FSMO

2. PowerShell:

PowerShell can be employed to locate FSMO roles within an Active Directory by utilizing the Get-AdForest cmdlet to retrieve Schema Master and Domain Name Master roles. Additionally, the Get-AdDomain cmdlet can be employed to obtain PDCEmulator, RIDMaster, and InfrastructureMaster roles.

• The Get-AdForest command is utilized to retrieve the Domain Name Master and Schema Master FSMO roles within an Active Directory forest. Employ the following command:
  Get-ADForest | fl SchemaMaster,DomainNamingMaster

• The Get-AdDomain command is employed to retrieve domain FSMO roles such as RID Master, PDC Emulator, and Infrastructure Master.
  Get-ADDomain | Select-Object InfrastructureMaster, RIDMaster, PDCEmulator

3. GUI (Graphical User Interface):

The identification of FSMO role holders is facilitated through the utilization of specific AD snap-ins. Refer to this table to determine the appropriate tool for each FSMO role.

FSMO Role	Which snap-in should I use?
Schema	Schema snap-in
Domain Naming	AD Domains and Trusts snap-in
RID	AD Users and Computers snap-in
PDC Emulator	AD Users and Computers snap-in
Infrastructure	AD Users and Computers snap-in

a. Active Directory Schema:

• Open Command Prompt as an administrator.
  
• Execute regsvr32 schmmgmt.dll
  
• Launch the MMC snap-in using mmc.exe
  
• Click File and then Add/Remove Snap-ins
  ,
• In the Add or Remove Snap-ins window, from the left side select Active Directory Schema and click the Add button, the Active Directory Schema snap-in will be moved to the right side under the Selected snap-ins, click OK
  
• From the left side pane, right Click the Active Directory Schema, Navigate to Operations Master to identify the Schema master.
  
• The current schema master will be displayed

b. Active Directory Domains and Trusts:

• Open Active Directory Domains and Trusts.
• Right-click  Active Directory Domains and Trust and click Operations Master
  
• The Domain naming operations master will be displayed
  

c. Active Directory Users and Computers:

• Open Active Directory Users and Computers.
• Right-click on the domain and check Operations Master
  
  
• Check the different tabs ( RID, PDC, Infrastructure ) to identify the RID master, PDC emulator, and Infrastructure operations master.
  

 

Conclusion:

Having acquired knowledge about various techniques for verifying FSMO roles within Active Directory, you now possess a versatile set of tools, such as command line utilities, PowerShell scripts, and graphical interfaces. This diversity enables you to choose an approach that aligns seamlessly with your preferences and operational requirements. Whether you opt for the command line for its precision, harness the power of PowerShell for scripting capabilities, or leverage the user-friendly graphical interface, the flexibility afforded by these methods empowers you to effortlessly identify the Domain Controller responsible for each FSMO role in your Active Directory environment.

By adapting the approach to your unique preferences, you enhance your efficiency and proficiency in managing and maintaining FSMO roles within the Active Directory infrastructure.