AD FSMO Roles

If you are restarting a DC, there is no need to transfer the FSMO roles to another DC for the duration of the restart. All that will happen if you do this is that AD operations handled by the FSMO roles that DC holds will be unavailable until the server comes back up. For example, Schema operations will not be possible during a restart of the Schema Master Operations role holder.

However, if you're formatting and wiping a DC, you MUST transfer the FSMO roles off of it and demote it gracefully using dcpromo prior to formatting.

Placing the Infrastructure Master role on a Global Catalog is not supported, since a GC holds a partial copy of every object in the forest. That server will therefore not act correctly as an Infrastructure Master since no records will be updated by the server. This does not apply in either a single-domain forest, or in an environment where ALL DCs are also Global Catalog servers.

Seizing FSMO roles: http://www.petri.co.il/seizing_fsmo_roles.htm. Also, remember to do a metadata cleanup of a failed DC.

By default, no machine will authenticate with a DC if the time is out by more than 5 - 15 minutes. It is the time difference between the machine being used at login and the authenticating DC which is used to determine whether there is a change.

-Matt

if a DC has 5 FSMO roles and it happens do die, how would you seize roles from it? would you use a restore from previous backup?

You would seize the roles from it using ntdsutil
http://support.microsoft.com/kb/216498
You would also never bring that server back online.
 
Thanks
Mike
 

when you run ntdsutil, then you are supposed  establish connection to a DC that no longer exist(crashed), how does this work to connect to a crashed server and seize its roles?

You don't connect to the failed server. You connect to one of the remaining DCs on which you want to make the changes to Active Directory, and the DC you want to seize the FSMO roles to. These changes will then replicate to other DCs on the domain.

-Matt

so in fact it's creating new roles not seizing roles.
Because if the DC that has 5 roles died completely and can't be brought online, then you use Ntdsutil from a working DC to "SEIZE" the roles to another working DC, what you are doing is creating new roles and not "SIEZING" them from the dead DC.  Correct?

by the way if you have only 2 DCs and the 5 FSMO role- holder died, can you create "SEIZE" the roles
on the only one working  DC?

Yes if you have 5 FSMO roles and that box dies then yes you can seize those roles to your working DC
...hopefully that never happens to you.
Thanks
Mike

It still confusing.
it's like:
If A owes money to B and C and A dies how are B and C going to get the money back.

so the 5-FSMO DC holder died , does that mean 5 FSMOs are inside the dead DC?
if so how are you going to get them from the Dead DC?

did you get my point?

I got it now. Thanks