We help IT Professionals succeed at work.

FSMO roles for 5 domain controllers-Best way to place them

Indie101
Indie101 asked
on
294 Views
Last Modified: 2018-04-05
One domain controller holds all FSMO domain roles
-Infrastructure master
-RID Master
-PDC Emulator

The same domain controller holds all FSMO forest roles as well
-Domain Naming Master
-Schema Master

There are 5 domain controllers think there is a better way to separate this,

https://support.microsoft.com/en-us/help/223346/fsmo-placement-and-optimization-on-active-directory-domain-controllers

What would be the best way to organise this?

I would think the forest roles and domain roles should be on different domain controllers? Correct?
Comment
Watch Question

MaheshArchitect
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
CERTIFIED EXPERT
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
System Administrator / Postmaster
CERTIFIED EXPERT
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
Hi admin I would like to amend this and add mahesh to the list to get points? I was accessing on my phone and didnt fully see the list of contributors so would like to amend and split 3 ways if possible
MaheshArchitect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
@MichelAgenlo:
You cannot move schema master role to dc in other domains such as child or tree root domain
Schema master starts with forest root domain and ends with root domain only it can be moved to dcs in root domain only
MichelangeloSystem Administrator / Postmaster
CERTIFIED EXPERT

Commented:
@Mahesh
Thank you for pointing it out. You can perform schema updates as long as the host you're updating from is in the same domain/site of the schema master FSMO role holder.
You can transfer FSMO role actually, as per
 
https://support.microsoft.com/en-us/help/324801/how-to-view-and-transfer-fsmo-roles-in-windows-server-2003

https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control


NOTE:  The Schema container (cn=schema,cn=configuration,dc=< forest root domainName >) contains all of the class and attribute definitions that are required to locate objects in Active Directory and to create new objects. It is the topmost object of the schema directory partition.
The schema is replicated on ALL DCs of the forest. FSMO schema master role can reside on any DC. Just test it in lab.
MaheshArchitect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
@Michel
1st of all, no matter where u install apps in child / parent, schema modification always done in root domain and as part of replication it replicated to other domains
Show me any article where it states that u can or need to move schema master to child domain when you install exchange in child domain
I also did exchange installations in child domain, always did schema modification in root domain once for All, u do need to prepare child domain
The reason u cannot do this because you cannot change root domain, when u 1st create active directory, the 1st domain become root domain and this remains *root*, child domain cannot be converted to root domain. Hence schema master cannot be transferred or seized to child domain, if parent domain dies, u need to restore it from backup and seize operations master. The same thing is true in case of naming master
Check below just for reference
https://www.experts-exchange.com/questions/28623648/Can-I-seize-FSMO-Roles-if-my-Root-Parent-Domain-Controller-Died-and-my-Child-Domain-Controllers-are-still-operational.html
MichelangeloSystem Administrator / Postmaster
CERTIFIED EXPERT

Commented:
@mahesh,
Schema object is replicated forestwide, so you can update it forestwide. That means on all DCs of the forest. I just confirmed on a windows 2008 r2 FFL forest that the role can be transferred via ntdsutil and schema management mmc. Will provide screenshots later. Moreover, Microsoft technet says that schema master fsmo role can be moved to any DC. Since we are unable to find an agreement on this and since I just confirmed this in my lab, I invite readers to test for themselves and we continue via PM and getback to this question when we are able to converge on an answer.
MaheshArchitect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Sure
Let me also test and will get back on same thread though question is closed
MichelangeloSystem Administrator / Postmaster
CERTIFIED EXPERT

Commented:
From Active Directory, 5th Ed.:
It is a common misunderstanding that the schema and domain naming masters cannot be hosted outside of the root domain. Any domain controller in the forest (from any domain) can host the schema and domain naming master FSMO roles. In general, we recommend that these FSMOs be kept on a domain controller in the forest root unless you have a reason to place them elsewhere.”
MaheshArchitect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
@Michel
You are right
I have also tested in lab and working as expected
This thread can be used by others as reference

Thanks
Mahesh.

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.