Avatar of Indie101
Indie101

asked on 

FSMO roles for 5 domain controllers-Best way to place them

One domain controller holds all FSMO domain roles
-Infrastructure master
-RID Master
-PDC Emulator

The same domain controller holds all FSMO forest roles as well
-Domain Naming Master
-Schema Master

There are 5 domain controllers think there is a better way to separate this,

https://support.microsoft.com/en-us/help/223346/fsmo-placement-and-optimization-on-active-directory-domain-controllers

What would be the best way to organise this?

I would think the forest roles and domain roles should be on different domain controllers? Correct?
* fsmoActive Directory

Avatar of undefined
Last Comment
Mahesh
SOLUTION
Avatar of Mahesh
Mahesh
Flag of India image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
SOLUTION
Avatar of ITguy565
ITguy565
Flag of United States of America image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER CERTIFIED SOLUTION
Avatar of Michelangelo
Michelangelo
Flag of Italy image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
Avatar of Indie101
Indie101

ASKER

Hi admin I would like to amend this and add mahesh to the list to get points? I was accessing on my phone and didnt fully see the list of contributors so would like to amend and split 3 ways if possible
Avatar of Mahesh
Mahesh
Flag of India image

@MichelAgenlo:
You cannot move schema master role to dc in other domains such as child or tree root domain
Schema master starts with forest root domain and ends with root domain only it can be moved to dcs in root domain only
Avatar of Michelangelo
Michelangelo
Flag of Italy image

@Mahesh
Thank you for pointing it out. You can perform schema updates as long as the host you're updating from is in the same domain/site of the schema master FSMO role holder.
You can transfer FSMO role actually, as per
 
https://support.microsoft.com/en-us/help/324801/how-to-view-and-transfer-fsmo-roles-in-windows-server-2003

https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control


NOTE:  The Schema container (cn=schema,cn=configuration,dc=< forest root domainName >) contains all of the class and attribute definitions that are required to locate objects in Active Directory and to create new objects. It is the topmost object of the schema directory partition.
The schema is replicated on ALL DCs of the forest. FSMO schema master role can reside on any DC. Just test it in lab.
Avatar of Mahesh
Mahesh
Flag of India image

@Michel
1st of all, no matter where u install apps in child / parent, schema modification always done in root domain and as part of replication it replicated to other domains
Show me any article where it states that u can or need to move schema master to child domain when you install exchange in child domain
I also did exchange installations in child domain, always did schema modification in root domain once for All, u do need to prepare child domain
The reason u cannot do this because you cannot change root domain, when u 1st create active directory, the 1st domain become root domain and this remains *root*, child domain cannot be converted to root domain. Hence schema master cannot be transferred or seized to child domain, if parent domain dies, u need to restore it from backup and seize operations master. The same thing is true in case of naming master
Check below just for reference
https://www.experts-exchange.com/questions/28623648/Can-I-seize-FSMO-Roles-if-my-Root-Parent-Domain-Controller-Died-and-my-Child-Domain-Controllers-are-still-operational.html
Avatar of Michelangelo
Michelangelo
Flag of Italy image

@mahesh,
Schema object is replicated forestwide, so you can update it forestwide. That means on all DCs of the forest. I just confirmed on a windows 2008 r2 FFL forest that the role can be transferred via ntdsutil and schema management mmc. Will provide screenshots later. Moreover, Microsoft technet says that schema master fsmo role can be moved to any DC. Since we are unable to find an agreement on this and since I just confirmed this in my lab, I invite readers to test for themselves and we continue via PM and getback to this question when we are able to converge on an answer.
Avatar of Mahesh
Mahesh
Flag of India image

Sure
Let me also test and will get back on same thread though question is closed
Avatar of Michelangelo
Michelangelo
Flag of Italy image

From Active Directory, 5th Ed.:
It is a common misunderstanding that the schema and domain naming masters cannot be hosted outside of the root domain. Any domain controller in the forest (from any domain) can host the schema and domain naming master FSMO roles. In general, we recommend that these FSMOs be kept on a domain controller in the forest root unless you have a reason to place them elsewhere.”
Avatar of Mahesh
Mahesh
Flag of India image

@Michel
You are right
I have also tested in lab and working as expected
This thread can be used by others as reference

Thanks
Mahesh.
Active Directory
Active Directory

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.

86K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
Ask the experts
Read over 600 more reviews

TRUSTED BY

IBM logoIntel logoMicrosoft logoUbisoft logoSAP logo
Qualcomm logoCitrix Systems logoWorkday logoErnst & Young logo
High performer badgeUsers love us badge
LinkedIn logoFacebook logoX logoInstagram logoTikTok logoYouTube logo