Domain Controller and FSMO Roles

I was wondering if anyone could help me out with an issue we are having.  We have 5 DCs in our environment.  We have the FSMO roles set on two of the domain controllers, one dc has the Domain role owner and Schema owner roles.  The other dc has the PDC, RID, and Infrastructure roles.  

Today and in the past when the DC which handles the PDC, RID and Infrastructure roles goes down, our users can't get authenticated to our exchange server and also have issues logging into their workstations.  

I assuming these roles aren't getting transferred when that DC goes down.  Shouldn't this be done automatically or is this something we would need to do by running the FSMO transfer command.  Once we got the server back up we didn't have any issues.

So I wondering why these roles don't get transferred...maybe something isn't setup right in our environment.  

Who is Participating?
Mike KlineConnect With a Mentor Commented:
They don't automatically get transferred when the DC is off or down.  You would need to do that yourself.  

If you demote a DC with FSMO roles and don't transfer them prior then they will get transferred.

Is your other DC a global catalog server?


ChrisConnect With a Mentor Commented:
no it doesn't get transfer automatically if i remember rightly if you lose both PDC emulator and RID roles then you aren't going to be able to logon
you should be able to use cached logons if you have that set in group policy
When you do maintenance you should think about transferring the roles if you have any apps that run 24/7
sunnyc7Connect With a Mentor Commented:
Shouldn't this be done automatically or is this something we would need to do by running the FSMO transfer command.

>> Roles wont get transferred automatically.
You need to configure another DC with these roles, so that they can handle situations like this, when a DC is restarted.
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

chris5472Author Commented:
Thanks everyone for if the DC that houses the  PDC, RID and Infrastructure roles goes down and is not reachable.  I would have to seize the role?

 Seize FSMO roles
To seize the FSMO roles by using the Ntdsutil utility, follow these steps:
1.Log on to a Windows 2000 Server-based or Windows Server 2003-based member computer or domain controller that is located in the forest where FSMO roles are being seized. We recommend that you log on to the domain controller that you are assigning FSMO roles to. The logged-on user should be a member of the Enterprise Administrators group to transfer schema or domain naming master roles, or a member of the Domain Administrators group of the domain where the PDC emulator, RID master and the Infrastructure master roles are being transferred.
2.Click Start, click Run, type ntdsutil in the Open box, and then click OK.
3.Type roles, and then press ENTER.
4.Type connections, and then press ENTER.
5.Type connect to server servername, and then press ENTER, where servername is the name of the domain controller that you want to assign the FSMO role to.
6.At the server connections prompt, type q, and then press ENTER.
7.Type seize role, where role is the role that you want to seize. For a list of roles that you can seize, type ? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article. For example, to seize the RID master role, type seize rid master. The one exception is for the PDC emulator role, whose syntax is seize pdc, not seize pdc emulator.
8.At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.

I was also wondering if anyone has VM'd their DCs.  We are running VMWare 4.0 and have virtualized all but one DC.  This DC has PDC, RID and Infrastructure roles, I pretty sure Microsoft doesn't support DCs that are VM'd.  

My thinking is transferring the 3 roles to one of the virtualized DC's and be done with it....what do you guys think?  But i'm just worried that we won't get support from MS if we have any issues in the future.

didnt understand what you mean by Going Down ?

Do you mean goes down as in restarts ?
or Goes down as in the OS is not bootable ?

You will need to seize the roles if the OS is not bootable or you need to demote the DC and move the roles to a better hardware to do a DC's job

Please clarify
Mike KlineCommented:
Yes we have fully virtualized all our DCs, fully supported.  See this question I helped with from a few days ago

Only seize the roles if that DC is going to be down forever and not coming back up.  Don't seize the roles and bring the original back up.  Seizing is a drastic step.


as mkline71 says only seize the roles if you are up that familiar creek without a paddle.

The only caveat to the virtual DC's are - don't pause the VM's that will corrupt the AD Database
Careful with Time Sync on virtual DC's the clock can get a bit screwy under load
Make sure you have good backups of both the full VM and separate system state backups
don't rely on just Virtual VM's if you don't have resiliency in your storage other wise when it comes to a DR event and you have lost your SAN you aren't going to be able to do much
it saves hassle if you don't virtualise your DHCP server or at least have physical resiliency with it
Like mentioned earlier by Mike, make sure you have some Global Catalogs available so users can log in if the PDCe is down for maintenance.

cmd -> dsquery server -isgc
chris5472Author Commented:
Thanks everyone for your help on this!!!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.