Scribd
Upload
17 views

FSMO

The document discusses the five Flexible Single Master Operations (FSMO) roles in Active Directory: 1. The Primary Domain Controller (PDC) Emulator role is responsible for compatibility with older NT 4.0 domains and synchronizing time services and group policies. 2. The RID Master role ensures each object has a unique identifier number assigned across domain controllers to avoid duplicates. 3. The Infrastructure Master role checks object membership in other domains, especially for universal groups, to prevent security issues from inaccurate membership data. 4. The Domain Naming Master role ensures no duplicate domain names are created when new child domains are added, which happens infrequently. 5. The Schema Master

Uploaded by

Mari Kani
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
17 views

FSMO

The document discusses the five Flexible Single Master Operations (FSMO) roles in Active Directory: 1. The Primary Domain Controller (PDC) Emulator role is responsible for compatibility with older NT 4.0 domains and synchronizing time services and group policies. 2. The RID Master role ensures each object has a unique identifier number assigned across domain controllers to avoid duplicates. 3. The Infrastructure Master role checks object membership in other domains, especially for universal groups, to prevent security issues from inaccurate membership data. 4. The Domain Naming Master role ensures no duplicate domain names are created when new child domains are added, which happens infrequently. 5. The Schema Master

Uploaded by

Mari Kani
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 1

FSMO Transfer Process 2003 SERVER

(Flexible Single Master Operations)

The Five FSMO Roles

There are just five operations where the usual multiple master model breaks down,
and the Active Directory task must only be carried out on one Domain Controller. 
FSMO roles:

1. PDC Emulator - Most famous for backwards compatibility with NT 4.0


BDC's.  However, there are two other FSMO roles which operate even in
Windows 2003 Native Domains, synchronizing the W32Time service and
creating group policies.  I admit that it is confusing that these two jobs
have little to do with PDCs and BDCs. 

2. RID Master - Each object must have a globally unique number (GUID). 
The RID master makes sure each domain controller issues unique
numbers when you create objects such as users or computers.  For
example DC one is given RIDs 1-4999 and DC two is given RIDs 5000 -
9999.

3. Infrastructure Master - Responsible for checking objects in other other


domains.  Universal group membership is the most important example. 
To me, it seems as though the operating system is paranoid that, a) You
are a member of a Universal Group in another domain and b) that group
has been assigned Deny permissions.  So if the Infrastructure master
could not check your Universal Groups there could be a security breach.

4. Domain Naming Master - Ensures that each child domain has a unique
name.  How often do child domains get added to the forest?  Not very
often I suggest, so the fact that this is a FSMO does not impact on normal
domain activity.  My point is it's worth the price to confine joining and
leaving the domain operations to one machine, and save the tiny risk of
getting duplicate names or orphaned domains.

Schema Master - Operations that involve expanding user properties e.g. Exchange 2003 /
forestprep which adds mailbox properties to users.  Rather like the Domain naming master,
changing the schema is a rare event.  However if you have a team of Schema
Administrators all experimenting with object properties, you would not want there to be a
mistake which crippled your forest.  So its a case of Microsoft know best, the Schema
Master should be a Single Master Operation and thus a FSMO role

You might also like