Avatar of Indie101
Indie101 asked on

FSMO roles for 5 domain controllers-Best way to place them

One domain controller holds all FSMO domain roles
-Infrastructure master
-RID Master
-PDC Emulator

The same domain controller holds all FSMO forest roles as well
-Domain Naming Master
-Schema Master

There are 5 domain controllers think there is a better way to separate this,

https://support.microsoft.com/en-us/help/223346/fsmo-placement-and-optimization-on-active-directory-domain-controllers

What would be the best way to organise this?

I would think the forest roles and domain roles should be on different domain controllers? Correct?
* fsmoActive Directory

Avatar of undefined
Last Comment
Mahesh

8/22/2022 - Mon
SOLUTION
Mahesh

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
SOLUTION
ITguy565

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
ASKER CERTIFIED SOLUTION
Log in to continue reading
Log In
Sign up - Free for 7 days
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
ASKER
Indie101

Hi admin I would like to amend this and add mahesh to the list to get points? I was accessing on my phone and didnt fully see the list of contributors so would like to amend and split 3 ways if possible
Mahesh

@MichelAgenlo:
You cannot move schema master role to dc in other domains such as child or tree root domain
Schema master starts with forest root domain and ends with root domain only it can be moved to dcs in root domain only
Michelangelo

@Mahesh
Thank you for pointing it out. You can perform schema updates as long as the host you're updating from is in the same domain/site of the schema master FSMO role holder.
You can transfer FSMO role actually, as per
 
https://support.microsoft.com/en-us/help/324801/how-to-view-and-transfer-fsmo-roles-in-windows-server-2003

https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control


NOTE:  The Schema container (cn=schema,cn=configuration,dc=< forest root domainName >) contains all of the class and attribute definitions that are required to locate objects in Active Directory and to create new objects. It is the topmost object of the schema directory partition.
The schema is replicated on ALL DCs of the forest. FSMO schema master role can reside on any DC. Just test it in lab.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
Mahesh

@Michel
1st of all, no matter where u install apps in child / parent, schema modification always done in root domain and as part of replication it replicated to other domains
Show me any article where it states that u can or need to move schema master to child domain when you install exchange in child domain
I also did exchange installations in child domain, always did schema modification in root domain once for All, u do need to prepare child domain
The reason u cannot do this because you cannot change root domain, when u 1st create active directory, the 1st domain become root domain and this remains *root*, child domain cannot be converted to root domain. Hence schema master cannot be transferred or seized to child domain, if parent domain dies, u need to restore it from backup and seize operations master. The same thing is true in case of naming master
Check below just for reference
https://www.experts-exchange.com/questions/28623648/Can-I-seize-FSMO-Roles-if-my-Root-Parent-Domain-Controller-Died-and-my-Child-Domain-Controllers-are-still-operational.html
Michelangelo

@mahesh,
Schema object is replicated forestwide, so you can update it forestwide. That means on all DCs of the forest. I just confirmed on a windows 2008 r2 FFL forest that the role can be transferred via ntdsutil and schema management mmc. Will provide screenshots later. Moreover, Microsoft technet says that schema master fsmo role can be moved to any DC. Since we are unable to find an agreement on this and since I just confirmed this in my lab, I invite readers to test for themselves and we continue via PM and getback to this question when we are able to converge on an answer.
Mahesh

Sure
Let me also test and will get back on same thread though question is closed
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
Michelangelo

From Active Directory, 5th Ed.:
It is a common misunderstanding that the schema and domain naming masters cannot be hosted outside of the root domain. Any domain controller in the forest (from any domain) can host the schema and domain naming master FSMO roles. In general, we recommend that these FSMOs be kept on a domain controller in the forest root unless you have a reason to place them elsewhere.”
Mahesh

@Michel
You are right
I have also tested in lab and working as expected
This thread can be used by others as reference

Thanks
Mahesh.