{"id":2611,"date":"2024-12-28T08:30:23","date_gmt":"2024-12-28T14:30:23","guid":{"rendered":"https:\/\/techlensfocus.com\/?p=2611"},"modified":"2024-12-28T08:30:23","modified_gmt":"2024-12-28T14:30:23","slug":"how-to-transfer-fsmo-roles-in-windows-server","status":"publish","type":"post","link":"https:\/\/techlensfocus.com\/index.php\/2024\/12\/28\/how-to-transfer-fsmo-roles-in-windows-server\/","title":{"rendered":"How to transfer FSMO Roles in Windows Server"},"content":{"rendered":"\n
Table of Contents<\/div>
<\/span><\/span><\/span><\/span><\/div><\/div>
<\/div>
    <\/ol><\/div><\/div><\/div>\n\n\n\n

    <\/p>\n\n\n\n

    Introduction<\/h2>\n\n\n\n

    <\/p>\n\n\n\n

    FSMO (Flexible Single Master Operations) roles are critical components in an Active Directory environment. When upgrading or transitioning domain controllers, it’s essential to transfer these roles to ensure a smooth operation.<\/p>\n\n\n\n

    Go to this post<\/a> if you want to learn what are FSMO Roles and how to manage them.<\/p>\n\n\n\n

    In this guide, we will walk you through the step-by-step process to transfer FSMO roles between Domain Controllers. <\/p>\n\n\n\n

    <\/p>\n\n\n\n

    Lab Topology<\/h2>\n\n\n\n

    <\/p>\n\n\n\n

    Here is our lab setup (techexample.local<\/strong>) for the FSMO roles transfer:<\/p>\n\n\n\n

    Server<\/strong><\/td>IP Address<\/strong><\/td>Default Gateway<\/strong><\/td><\/tr>
    DC01<\/td>192.168.1.100<\/td>192.168.1.254<\/td><\/tr>
    WS01 (Secondary DC)<\/td>192.168.1.101<\/td>192.168.1.254<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    To learn how to setup this lab, go here<\/a>.<\/p>\n\n\n\n

    Let’s continue!<\/p>\n\n\n\n

    <\/p>\n\n\n\n

    Step-by-Step Guide to Transferring FSMO Roles<\/h2>\n\n\n\n

    <\/p>\n\n\n\n

    Prerequisites<\/h3>\n\n\n\n

    <\/p>\n\n\n\n

    When transferring FSMO roles:<\/p>\n\n\n\n

      \n
    • Make sure both source and target Domain Controllers must be online and communicating for a smooth transfer. In this lab, the Source DC is DC01 <\/strong>and the target DC is WS01<\/strong>.<\/li>\n\n\n\n
    • Ensure proper network connectivity and administrative credentials.<\/li>\n\n\n\n
    • Back up AD environment before making changes to FSMO roles.<\/li>\n<\/ul>\n\n\n\n

      <\/p>\n\n\n\n

      Transferring Domain-Specific FSMO Roles<\/h3>\n\n\n\n

      <\/p>\n\n\n\n

      Step 1: Connect to the Destination Server <\/h4>\n\n\n\n

      <\/p>\n\n\n\n

        \n
      • Log in to the server WS01<\/strong>. This will be our destination server. The target domain controller WS01 <\/strong>will receive the FSMO roles.<\/li>\n\n\n\n
      • Open Server Manager <\/strong>> Tools<\/strong> menu > Active Directory Users and Computers<\/strong>.<\/li>\n<\/ul>\n\n\n
        \n
        \"\"<\/figure><\/div>\n\n\n

        Step 2: Access Operations Masters<\/h4>\n\n\n\n

        <\/p>\n\n\n\n

          \n
        • In the Active Directory Users and Computers<\/strong> window, right-click your domain.<\/li>\n\n\n\n
        • Select Operations Masters<\/strong> from the context menu.<\/li>\n<\/ul>\n\n\n
          \n
          \"\"<\/figure><\/div>\n\n\n

          Step 3: Transfer the RID Master Role<\/h4>\n\n\n\n

          <\/p>\n\n\n\n

            \n
          • In the Operations Masters<\/strong> dialog, go to the RID<\/strong> tab.<\/li>\n\n\n\n
          • Note the current role holder, which is VM-DC01.techexample.local<\/strong>.<\/li>\n\n\n\n
          • Now, click Change<\/strong> and configure the transfer when prompted.<\/li>\n<\/ul>\n\n\n
            \n
            \"\"<\/figure><\/div>\n\n
            \n
            \"\"<\/figure><\/div>\n\n
            \n
            \"\"<\/figure><\/div>\n\n\n

            Step 4: Transfer the PDC Emulator Role<\/h4>\n\n\n\n
              \n
            • Switch to the PDC<\/strong> tab in the same Operations Masters<\/strong> dialog.<\/li>\n\n\n\n
            • Click Change<\/strong>, confirm the transfer, and acknowledge success.<\/li>\n<\/ul>\n\n\n
              \n
              \"\"<\/figure><\/div>\n\n
              \n
              \"\"<\/figure><\/div>\n\n
              \n
              \"\"<\/figure><\/div>\n\n\n

              Step 5: Transfer the Infrastructure Master Role<\/h4>\n\n\n\n

              <\/p>\n\n\n\n

                \n
              • Move the Infrastructure<\/strong> tab in the Operations Masters<\/strong> dialog.<\/li>\n\n\n\n
              • Repeat the same process: Click Change<\/strong>, confirm, and acknowledge success.<\/li>\n<\/ul>\n\n\n\n

                Close the Operations Masters<\/strong> dialog once all three roles are transferred.<\/p>\n\n\n

                \n
                \"\"<\/figure><\/div>\n\n
                \n
                \"\"<\/figure><\/div>\n\n
                \n
                \"\"<\/figure><\/div>\n\n\n

                PowerShell Method<\/h4>\n\n\n\n

                <\/p>\n\n\n\n

                On server WS01<\/strong>, open PowerShell as Administrator. Next, run the following commands to transfer each role:<\/p>\n\n\n\n

                # Obtain the FQDN of the server\n$serverFQDN = [System.Net.Dns]::GetHostByName($env:computerName).HostName\n\n# Obtain hostname\n$serverName = hostname\n\n# Transfer RID Master\nMove-ADDirectoryServerOperationMasterRole -Identity $serverName -OperationMasterRole RIDMaster\n\n# Transfer PDC Emulator\nMove-ADDirectoryServerOperationMasterRole -Identity $serverName -OperationMasterRole PDCEmulator\n\n# Transfer Infrastructure Master\nMove-ADDirectoryServerOperationMasterRole -Identity $serverName -OperationMasterRole InfrastructureMaster<\/pre>\n\n\n\n
                Next, use the following command to verify the current role holders:<\/p>\n\n\n\n
                Get-ADDomain | Select-Object RIDMaster, PDCEmulator, InfrastructureMaster<\/pre>\n\n\n\n
                <\/p>\n\n\n\n
                Transferring Forest-Wide FSMO Roles<\/h3>\n\n\n\n
                <\/p>\n\n\n\n
                Step 1: Register the Schema Admin DLL<\/h4>\n\n\n\n
                <\/p>\n\n\n\n
                  \n
                • On WS01 <\/strong>server, open Command Prompt<\/strong>, type regsvr32 schmmgmt.dll <\/strong>and press Enter<\/strong>.<\/li>\n\n\n\n
                • Click OK<\/strong> when the registration is successful.<\/li>\n<\/ul>\n\n\n
                  \n
                  \"\"<\/figure><\/div>\n\n\n
                  Step 2: Access Active Directory Schema<\/h4>\n\n\n\n
                  <\/p>\n\n\n\n
                    \n
                  • Open Run<\/strong>, type mmc<\/code>, and press Enter<\/strong> to open the Microsoft Management Console.<\/li>\n\n\n\n
                  • Go to File<\/strong> > Add\/Remove Snap-in…<\/strong><\/li>\n\n\n\n
                  • Select Active Directory Schema<\/strong> from the list and click Add<\/strong>, then click OK<\/strong>.<\/li>\n<\/ul>\n\n\n
                    \n
                    \"\"<\/figure><\/div>\n\n
                    \n
                    \"\"<\/figure><\/div>\n\n
                    \n
                    \"\"<\/figure><\/div>\n\n\n
                    Step 3: Change the Schema Master Role <\/h4>\n\n\n\n
                    <\/p>\n\n\n\n
                      \n
                    • Expand Active Directory Schema<\/strong> in the MMC console.<\/li>\n\n\n\n
                    • Right-click Active Directory Schema <\/strong>and select Change Active Directory Domain Controller<\/strong>.<\/li>\n\n\n\n
                    • Choose WS01<\/strong> and click OK<\/strong>.<\/li>\n\n\n\n
                    • Right-click Active Directory Schema<\/strong> and select Operations Master<\/strong>.<\/li>\n\n\n\n
                    • Click Change<\/strong>, confirm the transfer, and acknowledge success.<\/li>\n<\/ul>\n\n\n
                      \n
                      \"\"<\/figure><\/div>\n\n
                      \n
                      \"\"<\/figure><\/div>\n\n\n
                      Notice that the Active Directory Schema is now connected to [VM-WS01.techexample.local<\/strong>] server.<\/p>\n\n\n
                      \n
                      \"\"<\/figure><\/div>\n\n\n
                        \n
                      • Right-click on Active Directory Schema<\/strong> and select Operations Master.<\/strong><\/li>\n\n\n\n
                      • In the Change Schema Master <\/strong>dialog box, click Change<\/strong>. Click Yes <\/strong>to proceed in the message box.<\/li>\n\n\n\n
                      • Click OK <\/strong>to acknowledge that the role transfer was successfully completed.<\/li>\n<\/ul>\n\n\n
                        \n
                        \"\"<\/figure><\/div>\n\n
                        \n
                        \"\"<\/figure><\/div>\n\n
                        \n
                        \"\"<\/figure><\/div>\n\n
                        \n
                        \"\"<\/figure><\/div>\n\n\n
                        The Schema Master role has now been transferred to VM-WS01<\/strong> server.<\/p>\n\n\n\n
                        <\/p>\n\n\n\n
                        Step 4: Transfer the Domain Naming  Master Role<\/h4>\n\n\n\n
                        <\/p>\n\n\n\n
                          \n
                        • We are still on the WS01 <\/strong>server. Open Server Manager<\/strong> > Tools<\/strong> > Active Directory Domains and Trusts<\/strong>.<\/li>\n\n\n\n
                        • Right-click Active Directory Domains and Trusts [VM-WS01.techexample.local]<\/strong> and select Operations Master<\/strong>.<\/li>\n\n\n\n
                        • Click Change<\/strong>, confirm, and acknowledge the successful transfer.<\/li>\n<\/ul>\n\n\n
                          \n
                          \"\"<\/figure><\/div>\n\n
                          \n
                          \"\"<\/figure><\/div>\n\n
                          \n
                          \"\"<\/figure><\/div>\n\n
                          \n
                          \"\"<\/figure><\/div>\n\n
                          \n
                          \"\"<\/figure><\/div>\n\n\n
                          PowerShell Method<\/h4>\n\n\n\n
                          Transfer the Schema Master<\/strong> role:<\/p>\n\n\n\n
                          # Obtain the hostname\n$serverName = hostname\n\n# Transfer Schema Master role\nMove-ADDirectoryServerOperationMasterRole -Identity $serverName -OperationMasterRole SchemaMaster<\/pre>\n\n\n\n
                          Transfer Domain Naming Master<\/strong> role:<\/p>\n\n\n\n
                          # Obtain the hostname\n$serverName = hostname\n\nMove-ADDirectoryServerOperationMasterRole -Identity $serverName -OperationMasterRole DomainNamingMaster<\/pre>\n\n\n\n
                          Verify the Forest-Wide FSMO roles:<\/p>\n\n\n\n
                          Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster<\/pre>\n\n\n\n
                          <\/p>\n\n\n\n
                          Demote the old Domain Controller (Optional)<\/h3>\n\n\n\n
                          <\/p>\n\n\n\n
                          One thing to note is that if you are demoting a domain controller after transferring roles, be sure to clean up DNS records<\/strong> and perform metadata cleanup<\/strong> using tools like ntdsutil<\/strong> to remove any lingering references. Here is how:<\/p>\n\n\n\n
                          <\/p>\n\n\n\n
                          Using Server Manager to demote DC<\/h4>\n\n\n\n
                          <\/p>\n\n\n\n
                            \n
                          • On DC01 <\/strong>server, open Server Manager<\/strong> and click on Manage<\/strong> > Remove Roles and Features<\/strong>.<\/li>\n\n\n\n
                          • In the Remove Roles and Features Wizard<\/strong>, click Next<\/strong> until you reach the Server Roles<\/strong> page.<\/li>\n\n\n\n
                          • Uncheck the Active Directory Domain Services<\/strong> role.<\/li>\n\n\n\n
                          • You will see a prompt indicating that the server is a domain controller and must be demoted first. Click Demote this domain controller<\/strong>.<\/li>\n\n\n\n
                          • In the Active Directory Domain Services Configuration Wizard<\/strong>:\n
                              \n
                            • Do not select the Force the removal of this domain controller<\/strong> checkbox unless necessary.<\/li>\n\n\n\n
                            • Provide the credentials of a Domain Administrator.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
                            • Click Next<\/strong> and confirm the demotion.<\/li>\n\n\n\n
                            • Once the demotion completes, the server will automatically restart and become a standalone server.<\/li>\n<\/ul>\n\n\n\n
                              <\/p>\n\n\n\n
                              Using PowerShell to demote DC<\/h4>\n\n\n\n
                              <\/p>\n\n\n\n
                              Remove Active Directory Domain Services<\/strong> Role:<\/p>\n\n\n\n
                              Uninstall-ADDSDomainController -DemoteOperationMasterRole -ForceRemoval -Credential (Get-Credential)<\/pre>\n\n\n\n
                                \n
                              • -DemoteOperationMasterRole<\/strong>: Demotes the DC even if it holds FSMO roles. Since FSMO roles are already transferred, this ensures no errors occur.<\/li>\n\n\n\n
                              • -ForceRemoval<\/strong>: Forces the demotion process.<\/li>\n<\/ul>\n\n\n\n
                                Enter the Domain Administrator credentials when prompted. After that, confirm the demotion when PowerShell asks for confirmation.<\/p>\n\n\n\n
                                After the demotion is complete, the server will reboot automatically and function as a standalone server.<\/p>\n\n\n\n
                                <\/p>\n\n\n\n
                                Cleaning up Metadata and DNS Records<\/h4>\n\n\n\n
                                <\/p>\n\n\n\n
                                Ensure there are no lingering references to the old DC using: <\/p>\n\n\n\n
                                ntdsutil metadata cleanup<\/pre>\n\n\n\n
                                Also, remove any old DNS records for the demoted DC. Moreover, make sure that the demoted server no longer appears in the list of domain controllers.<\/p>\n\n\n\n
                                <\/p>\n\n\n\n
                                Verification and Consideration<\/h2>\n\n\n\n
                                <\/p>\n\n\n\n
                                To verify the transfer, we use the Netdom Query FSMO<\/strong> command in PowerShell to list the current FSMO role holders.<\/p>\n\n\n\n
                                netdom query fsmo<\/pre>\n\n\n\n
                                Ensure all roles have been assigned to the WS01<\/strong> domain controller.<\/p>\n\n\n\n
                                Finally, to ensure proper replication between the domain controllers:<\/p>\n\n\n\n
                                repadmin \/replsummary\nrepadmin \/showrepl<\/pre>\n\n\n\n
                                <\/p>\n\n\n\n
                                Conclusion<\/h2>\n\n\n\n
                                <\/p>\n\n\n\n
                                In a nutshell, transferring FSMO roles is a straightforward yet critical task when upgrading or transitioning domain controllers. By following these steps, you can ensure your Active Directory environment remains stable and functional. Always remember to verify the transfer and maintain backups of your system to prevent data loss.<\/p>\n","protected":false},"excerpt":{"rendered":"
                                Exploring how to  transfer FSMO roles between Domain Controllers in Windows Server environment. This guide include essential steps and best practices.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[6,18],"tags":[86,27],"class_list":["post-2611","post","type-post","status-publish","format-standard","hentry","category-it","category-windowserver","tag-fsmo-roles","tag-windows-server"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/posts\/2611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/comments?post=2611"}],"version-history":[{"count":76,"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/posts\/2611\/revisions"}],"predecessor-version":[{"id":2715,"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/posts\/2611\/revisions\/2715"}],"wp:attachment":[{"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/media?parent=2611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/categories?post=2611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techlensfocus.com\/index.php\/wp-json\/wp\/v2\/tags?post=2611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}