The Life of Brian : FSMO

Active Directory Domain Services Resources

BrianM — Fri, 09 Jan 2009 17:36:00 GMT

I pulled together a few links to help point people in the right direction on resources for AD in Windows Server 2008. You’ll find all kinds of goodies, from virtual labs to videos by some of your favorite public speakers and of course what I think...(read more)

How to Remove a Failed or Offline DC

BrianM — Wed, 17 Dec 2008 20:13:00 GMT

I’ve seen this issue come up time and time again. Some administrator decided to remove an old DC from the network but forgot to remove it from Active Directory or the DC has entered a failed state and cannot be recovered from. In a perfect...(read more)

Must Have Group Policy Setting!

BrianM — Fri, 14 Nov 2008 21:22:00 GMT

I recently blogged about time and how critical it is in a domain environment. Just this morning I read a post from the Directory Services Team that shows how to configure WMI Filtering through Group Policy to ensure that the PDC Emulator always has the...(read more)

What W32tm is it anyway?

BrianM — Fri, 10 Oct 2008 16:49:00 GMT

My daughter Alyssa and I play a game…well she might not consider it a game but she is constantly asking me “What time is it without looking”. I’ve actually gotten pretty good at it and can usually get within a few minutes. Not sure why...(read more)

Windows Server 2008 Component Posters

BrianM — Fri, 27 Jul 2007 15:41:00 GMT

Back in January of 2007 I posted that TechNet Magazine had a really cool poster that showed Active Directory as a Jigsaw puzzle. I noticed in my latest copy of TechNet Magazine that it included two new posters. One of them was another Active Directory...(read more)

TechNet's Active Directory Jigsaw

BrianM — Fri, 05 Jan 2007 03:23:00 GMT

At last year’s Tech-Ed TechNet Magazine gave away a really cool Active Directory Jigsaw puzzle. I just saw that it is now available online to download. I think it is a great resource for everyone who interacts with Active Directory to look at. Check out...(read more)

Where are my FSMO roles?

BrianM — Wed, 16 Aug 2006 13:54:00 GMT

I have seen so many Active Directory Admins use so many methods to find out who and where their FSMO role holders are. Some will use the old fashion way of going through the AD tools and viewing the roles there. Others that have experience scripting have...(read more)

Dissecting the Active Directory Infrastructure Master Role

BrianM — Thu, 06 Jul 2006 17:01:00 GMT

Dean Wells has a very interesting and in-depth look at this FSMO role. This will actually be an 8 part series that looks into this DC role. Teaching AD for years this was always a mystery to students on what this role really did. For those that love the...(read more)

Gotcha with changing the Schema Master

BrianM — Mon, 24 Apr 2006 19:45:00 GMT

Changing FSMO roles isn't that difficult. In fact you can see a great video that I create on it right here. The one that seems to get everyone is the Schema Master. The reason being is because when you open the Schema snap-in it always opens it connected to the Schema Master...regardless of what machine you open the tool on. If you don't see this, when you attempt to transfer the role it won't let you because it will show the server names in both areas.

So if you want to change the Schema Master role make sure to right click Active Directory Schema and select Change Domain Controller... like shown below (real names blanked out to protect the innocent).

After you change that to the DC that you want to transfer the role to go ahead and select Operation Master... You should now see the DC that you are connected to on the bottom box. Make the transfer and all should be well.

Change That Schema Safely!!!

BrianM — Tue, 11 Apr 2006 22:52:00 GMT

Whenever a product requires extending the schema great caution must be taken. If something goes wrong during this process you can have long last problems. Below are some guidelines that I like to follow when going through such a process.

Needless to say you really should have at least two if not three environments. Production, Integration, and Development. In my eyes the Dev env. is a free for all. The Integration env. should closely mirror your Production env. Last but not least is your actual Production env., this is it your real network that users depend on (even though they don't seem to care when it's up and running just fine).

Log on to the Domain Controller serving the Schema Master FSMO role
Resolve any outstanding replication issues:
repadmin /replsummary /bydst /bysrc /sort:delta
Back up the system state on the Schema Master
Disable outbound replication on the Schema Master:
repadmin /options <schemamasterdcname> +DISABLE_OUTBOUND_REPL
Perform the extension
Verify there were no errors; if so, restore the Schema Master from the system state backup
Re-enable outbound replication:
repadmin /options <schemamasterdcname> -DISABLE_OUTBOUND_REPL
Schema updates will flow. You can run: 'repadmin /showreps <dcname>' to get a look at the status of any DC's replication with their immediate partners