page contents

About the Post

Author Information

Transferring FSMO Roles in Windows 2008 using ntdsutil

How can I transfer some or all of the FSMO Roles from one DC to another using the command line? Great question!

NOTE: For doing this task in the GUI, please see this blog: Transferring FSMO Roles in Windows Server 2008 (Has some great screen-shots)

Windows 2008 Active Directory domains utilize a Single Operation Master method called FSMO (Flexible Single Master Operation), as described in Understanding FSMO Roles in Active Directory.

In most cases an administrator could keep the FSMO role holders (all 5 of them) in the same spot (or actually, on the same DC) as has been configured by the Active Directory installation process. However, there are scenarios where you would want to move one or more of the FSMO roles from the default holder to a different DC.

Moving the FSMO roles while both the original FSMO role holder and the future FSMO role holder are online and operational is called Transferring, and is described in this article.

The transfer of an FSMO role is the suggested form of moving a FSMO role between domain controllers and can be initiated by the administrator or by demoting a domain controller. However, the transfer process is not initiated automatically by the operating system, for example a server in a shut-down state. FSMO roles are not automatically relocated during the shutdown process – this must be considered when shutting down a domain controller that has an FSMO role for maintenance, for example.

In a graceful transfer of an FSMO role between two domain controllers, a synchronization of the data that is maintained by the FSMO role owner to the server receiving the FSMO role is performed prior to transferring the role to ensure that any changes have been recorded before the role change.

However, when the original FSMO role holder went offline or becomes non-operational for a long period of time, the administrator should consider moving the FSMO role from the original, non-operational holder, to a DC that will be able to fulfill requests. The process of moving the FSMO role from a non-operational role holder to a different DC is called Seizing, and is described in the Seizing FSMO Roles article.

You can transfer FSMO roles by using the Ntdsutil.exe command-line utility or by using an MMC snap-in tool. Depending on the FSMO role that you want to transfer, you can use one of the following three MMC snap-in tools:

  • Active Directory Schema snap-in
  • Active Directory Domains and Trusts snap-in
  • Active Directory Users and Computers snap-in
The purpose of this article is to use the Ntdsutil.exe command-line utility. To transfer the FSMO role the administrator must be a member of the following group:
FSMO Role Administrator must be a member of
Schema Schema Admins
Domain Naming Enterprise Admins
RID Domain Admins
PDC Emulator
Infrastructure

Side note: To Transfer the Schema Master Role via the GUI, please note that you must first register this snap-in:

  1. Register the Schmmgmt.dll library by pressing Start > RUN and typing: regsvr32 schmmgmt.dll


  1. Press OK. You should receive a success confirmation.
  2. From the Run command open an MMC Console by typing MMC.
  3. On the Console menu, press Add/Remove Snap-in.
  4. Press Add. Select Active Directory Schema.
  5. Press Add and press Close. Press OK.
  6. If you are NOT logged onto the target domain controller, in the snap-in, right-click the Active Directory Schema icon in the Console Root and press Change Domain Controller.
  7. Press Specify …. and type the name of the new role holder. Press OK.
  8. Right-click right-click the Active Directory Schema icon again and press Operation Masters.
  9. Press the Change button.
  10. Press OK all the way out.

Transferring the FSMO Roles via Ntdsutil

To transfer the FSMO roles from the Ntdsutil command:

Caution: Using the Ntdsutil utility incorrectly may result in partial or complete loss of Active Directory functionality.

  1. On any domain controller, click Start, click Run, type Ntdsutil in the Open box, and then click OK. (Seen below in screen-shot)
C:\>ntdsutil
ntdsutil:

 

  1. Type roles, and then press ENTER.
ntdsutil: roles
fsmo maintenance:

Note: To see a list of available commands at any of the prompts in the Ntdsutil tool, type ?, and then press ENTER.

  1. Type connections, and then press ENTER.
fsmo maintenance: connections
server connections:
  1. Type connect to server <servername>, where <servername> is the name of the server you want to use, and then press ENTER.
server connections: connect to server bobafett
Binding to bobafett ...
Connected to bobafett using credentials of locally logged on user.
server connections:
  1. At the server connections: prompt, type q, and then press ENTER again.
server connections: q
fsmo maintenance:

  1. Type transfer <role>. where <role> is the role you want to transfer.

For example, to transfer the PDC Emulator role, you would type transfer pdc. To find all transfer commands type ? after you are in fsmo maintenance.

Options are shown in the following screenshot:

  1. You will receive a warning window asking if you want to perform the transfer. Click on Yes.
  2. After you transfer the roles, type q and press ENTER until you quit Ntdsutil.exe.
  3. Restart the server and make sure you update your backup.

For more context, please see this Microsoft KB Article: Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller

Tags: , , , , , ,

Trackbacks/Pingbacks

  1. Seizing FSMO Roles in Windows 2008 using ntdsutil | Scott Mattie's blog - February 20, 2012

    […] future FSMO role holder are online and operational is called Transferring, and is described in the Transferring FSMO Roles in Windows 2008 using ntdsutil […]

Copy Protected by Chetan's WP-Copyprotect.