Windows Domain Controller Operations Masters Placement
Active Directory Domain Services (AD DS) supports multimaster replication of directory data, which means any domain controller can accept directory changes and replicate the changes to all other domain controllers. However, certain changes, such as schema modifications, are impractical to perform in a multimaster fashion. For this reason certain domain controllers, known as operations masters, hold roles responsible for accepting requests for certain specific changes.
Three operations master roles (also known as flexible single master operations or FSMO) exist in each domain:
- The primary domain controller (PDC) emulator operations master processes all password updates.
- The relative ID (RID) operations master maintains the global RID pool for the domain and allocates local RIDs pools to all domain controllers to ensure that all security principals created in the domain have a unique identifier.
- The infrastructure operations master for a given domain maintains a list of the security principals from other domains that are members of groups within its domain.
In addition to the three domain-level operations master roles, two operations master roles exist in each forest:
- The schema operations master governs changes to the schema.
- The domain naming operations master adds and removes domains and other directory partitions (for example, Domain Name System (DNS) application partitions) to and from the forest.
Place the domain controllers hosting these operations master roles in areas where network reliability is high, and ensure that the PDC emulator and the RID master are consistently available.
Operations master role holders are assigned automatically when the first domain controller in a given domain is created. The two forest-level roles (schema master and domain naming master) are assigned to the first domain controller created in a forest. In addition, the three domain-level roles (RID master, infrastructure master, and PDC emulator) are assigned to the first domain controller created in a domain.
Typically I’ve found you want the RDC, RID Pool Manager, and Infrastructure Master on the Primary Domain Controller. You then want the last two, Schema Master and Domain Naming Master on a Secondary Domain Controller.
In order to verify Operation Master easily instead of going to each MMC module individually you can go to command prompt and type the following command:
“netdom query fsmo” and press enter.
It will show you where all of the Operation Masters are located. Might come in handy for someone when you remove a 2003 DC from a forest that was raised to 2008 so you can verify that there is no operations masters on the old 2003 DC.