objectives

70-294: MCSE Guide to Microsoft Windows Server 2003 Active

Directory, Enhanced

Chapter 8: Active Directory

Operations Masters

Guide to MCSE 70-294, Enhanced 2

Objectives

• Describe the forest-wide operations master roles and where they should be placed

• Describe the domain-wide operations master roles and where they should be placed

• Describe the process of transferring and seizing roles from operations masters


Forest-wide Roles

• Certain operations can only be performed by single domain controller in entire forest

• Forest-wide FSMO roles:• Schema master

• Domain naming master

• Can be located on different domain controllers• Most often located on same domain controller

• Easier management


Schema Master

• Allowed to make modifications to Active Directory schema

• Has writable copy of schema naming context for entire forest

• Changes replicated to other domain controllers • Using standard, non-urgent replication


Schema Master - Placement

• Assigned to first domain controller in forest• Additional load is negligible

• Often left on first domain controller in forest without any issues

• May be necessary to move • If server frequently unavailable


Schema Master - Impact if Unavailable

• Users do not notice impact• Network administrators most likely do not notice

loss• Unless they are attempting to modify schema


Activity 8-1: Identifying the Schema Master of a Forest

• Objective: Learn how to use the Active Directory Schema snap-in to identify the schema master of a forest

• Follow instructions to identify schema master


Identifying the Schema Master of the Forest


Domain Naming Master

• Every domain must have unique name• Adds domains to forest

• Ensure name is unique

• Removing domains from forest


Domain Naming Master - Placement

• Assigned to first domain controller in forest• Additional load negligible• Forest functional level of Windows 2000:

• Only place on global catalog server

• Forest functional level Windows Server 2003:• Not necessary to place on global catalog server


Domain Naming Master - Impact if Unavailable

• Users do not notice any impact• Network administrators most likely do not notice

loss • Unless they are attempting to add or remove domain

from forest


Domain-wide Roles

• Some operations can only be performed by single domain controller in domain

• Domain-wide FSMO roles:• PDC emulator

• RID master

• Infrastructure master


Domain-wide Roles – Placement Options

• All three reside on one domain controller• All three reside on different domain controllers• Any combination of:

• Two of the roles are on one domain controller

• Third role on its own domain controller

• Domain controller may even hold domain-wide roles and forest-wide roles


PDC Emulator

• Acts as Windows NT 4.0 PDC for domain• Replicate appropriate change(s) to Windows NT 4.0

BDCs in domain

• Responsible for performing operations for client workstations running:• Windows NT 4.0 Workstation

• Windows 98


PDC Emulator (continued)

• Used for synchronizing system clock• Password updates preferentially replicated to PDC

emulator


PDC Emulator - Placement

• Assigned to first domain controller in every new domain

• Should be highly available• Need additional processing power for PDC

emulator in a large domain• Or do not place on global catalog server

• Centrally located on network


PDC Emulator - Impact if Unavailable

• Users may notice impact• Validation of user passwords may randomly pass or fail

• Replication of updates to Windows NT 4.0 BDCs will not occur


RID Master

• Security principle has own unique security identifier (SID)• Made up of

• SID of domain

• Relative identifier (RID)

• RID is unique for every security principle in domain

• RID master • Allocates blocks of RIDs to domain controllers


RID Master (continued)

• Responsible for moving objects between domains to prevent object duplication• Move object to new domain

• Then delete it from old domain


RID Master - Placement


• Additional load negligible• Highly available• Locate in site where most new security principles

are created


RID Master - Impact if Unavailable

• Users do not notice any impact• Network administrators most likely do not notice

loss • Unless they are attempting to create many security

principles

• Domain controller runs out of RIDs


Infrastructure Master

• Update object references in its domain that point to objects located in another domain

• Updates distinguished name and SID if object moves within or between domains

• Object references contain:• GUID of object

• Distinguished name of object

• Possibly SID of object if it is security principle


Infrastructure Master - Placement

• Forest with multiple domains:• Do not place on global catalog server

• Do locate in site that contains global catalog server


• Does not place much additional load


Infrastructure Master - Impact if Unavailable

• Users typically do not notice any impact• Network administrators may notice that group

membership does not appear to be updated• User accounts may appear with incorrect names in

group’s membership list


Activity 8-3: Identifying the Domain-wide FSMO Role

Holders

• Objective: Learn how to use the Active Directory Users and Computers console to identify the PDC emulator, RID master, and infrastructure master of a domain

• Follow instructions to view masters


Transferring and Seizing Roles

• May be necessary to transfer FSMO roles• Usually orderly process• May be situations where original role holder is

permanently unavailable• Role will be seized by another domain controller


Transfer Roles

• Preferred method:• Perform transfer operation

• Both domain controllers must be available• Ensures no data loss occurs

• Administrator needs to be member of certain group• Depends on role being moved


Groups Authorized to Move FSMO Roles Between Domain

Controllers


Activity 8-4: Transferring Domain-wide FSMO Roles

• Objective: Learn how to transfer the infrastructure master role to another domain controller

• Use Active Directory Users and Computers to transfer role


Seizing Roles

• Transfer when original role holder is unavailable• Should only be done as last step• Any recent changes cannot be replicated

• May be lost

• Original role holder cannot be informed that it no longer holds the role

• Never place server back on network unless it is formatted and Windows is reinstalled


Consequences of Bringing a Domain Controller Back Online After FSMO Role

Seizure


Seizing Roles

• Methods:• Active Directory Users and Computers

• Use only for PDC emulator or infrastructure master

• NTDSUTIL


Activity 8-5: Using NTDSUTIL to Seize a FSMO Role

• Objective: Learn how to seize the infrastructure master role using NTDSUTIL

• Use NTDSUTIL to seize role


Seizing a FSMO Role Using NTDSUTIL


Summary

• Forest-wide operations master roles:• Schema master

• Domain naming master

• Domain-wide operations master roles: • PDC emulator

• RID master

• Infrastructure master

• Roles can be transferred/seized and given to another domain controller

objectives

Documents

single domain controller

domain controllerall

mcse guide

windows nt

domaindomainwide fsmo

enhancedschema master

forestwide rolesguide

seizing roles