- Introducing Operations Masters
- Planning for Business Continuity of Operations Master Roles
- Recommendations for Operations Masters
- Planning a Strategy for Placing Global Catalog Servers
- Need to Know More?
This chapter is from the book
This chapter is from the book
This chapter is from the book
Planning for Business Continuity of Operations Master Roles
Because the first DC installed in a domain (or the forest) assumes all the FSMO roles by default, it is highly likely that you will want to transfer at least some of the roles to other domain controllers later.
Before you can do this, however, you must determine which servers in your environment are currently performing each role. You can then gracefully move a role from one DC to another (known as transferring the role), or you can seize a role. Seizing a role is the act of taking control away from one DC and assigning it to another without the current operations master relinquishing its role first. You would do this if the DC acting as an operations master had failed and was no longer online. Because the server is not operational, it cannot gracefully give up its role; instead, the role must be seized.
Determining Operations Master Roles
The tools you use to determine which server is performing a specific role depend on the scope of the role. Remember that two of the five roles are forestwide. The remaining three are domain specific. You can use a single tool to determine the domain-level roles, but you must use different tools to figure out the forestwide roles.
Domain-Level Operations Master Roles
As mentioned, the three domain-level operations master roles are PDC Emulator, RID Master, and Infrastructure Master. You can use the Active Directory Users and Computers tool to find out which server or servers are playing this role. To do this, right-click Active Directory Users and Computers, navigate to All Tasks, and select Operations Masters, as shown in Figure 3.1.
)
Figure
3.1 Using AD Users and Computers to determine a role owner.
When you make this selection, you are presented with the Operations Masters dialog box, shown in Figure 3.2. There are three domain-level operations master roles, and each is displayed on its own tab. Along with the name of the system playing the role is a Change button, which you use to change the server playing the role, that is transfer the role.
)
Figure
3.2 The Operations Masters dialog box.
Forest-Level Operations Master Roles
As mentioned previously, two roles are forestwide: the Domain Naming Master and the Schema Master. You use two different tools to determine which DC is playing these roles. For the Domain Naming Master, you use Active Directory Domains and Trusts, which is found in the Administrative Tools menu. You navigate to the Change Operations Master dialog box, shown in Figure 3.3, in much the same way you reached the Operations Masters dialog box in the last section. In this case, right-click Active Directory Domains and Trusts and then select Operations Master. This brings up the Change Operations Master dialog box. You can change the name of the server that plays the role by clicking the Change button.
)
Figure
3.3 The Change Operations Master dialog box.
The Schema Master role is a little different. Editing the AD schema should be a very controlled process for several reasons. First, when a change is made to the schema, the change must be replicated to all DCs in the forest. This generates a lot of activity on those servers and consumes bandwidth. Second, you can never delete anything from the schema. You can only "deactivate" parts of the schema. That means an object can be deactivated but will still take up space within the schema definition.
To find out which server is playing the role of Schema Master, and also to change the name of the DC playing the role, you must use the Active Directory Schema MMC snap-in. By default, this snap-in is not available. To use it, you must first register the schema dynamic link library (DLL). To do this, open a Command Prompt window and type the following (you must be a Domain Admin or Enterprise Admin to complete this task):
This registers the DLL for use on your system. This command must be run on a Windows Server 2003 server. If the system root is not in your path, make sure you give the full path to the schmmgmt.dll file. The path should be <systemroot>\system32.
Once you have registered the DLL, you must create a custom MMC console. Follow these steps to create a custom console:
Select Start, Run and type MMC.
This brings up an empty console. Click the Console menu and select Add/Remove Snap-In.
This brings up the Add/Remove Snap-In dialog box. Click the Add button.
This displays the Add Standalone Snap-In dialog box. Select Active Directory Schema and click Add. Click Close and then OK.
To display the name of the DC playing the Schema Master role, right-click Active Directory Schema in the right-side panel and select Operations Master. This displays the Change Schema Master dialog box, shown in Figure 3.4. You can change the server name by clicking the Change button.
)
Figure
3.4 The Change Schema Master dialog box.
NOTE
Each of the methods given in this "Determining Operations Masters" section includes an option to connect to an alternative DC on the context-sensitive menu from which you chose the Operations Master option. Use this option to connect to other domains and to view or change the operations master in those domains.
Permissions for Changing an Operations Master Server
Before you can transfer a role from one server to another, you must make sure you have sufficient permissions. Table 3.2 details what these permissions should be. Pay particular attention to the Schema Master, because this is a special group within the domain.
Table 3.2 Required Permissions for Changing an Operations Master Role
|
Role |
Group with Permission |
|
PDC Emulator |
Domain Admins group |
|
RID Master |
Domain Admins group |
|
Infrastructure Master |
Domain Admins group |
|
Schema Master |
Schema Admins group |
|
Domain Naming Master |
Enterprise Admins group |
Seizing a Role
Transferring an operations master role from one server to another using the methods outlined in the previous sections is a graceful exchange—that is, an assumption is made that both servers are functioning. With both online, normal AD replication can take care of transferring necessary data from one server to another so it can perform its new role.
This is not always the case, however. If the server playing the role of operations master fails or becomes unavailable, it may be necessary to seize control of it. Seizing the role forces the transfer from one system to another. This is a last resort and is not recommended.
NOTE
Seizing a role is a serious matter and should be done in emergencies only. The server currently playing the role must not come back online. If it does, you will have a serious conflict on your network. If you want to reuse a server that previously played a role that has been seized, reformat the partition that contains Windows Server 2003 and reinstall the operating system.
The method used to seize a role depends on the operations master you are working with. If you need to seize the role for the PDC Emulator or the Infrastructure Master, you can go ahead and use the Active Directory Users and Computers console. Use the method outlined previously when viewing and changing the current DC playing the role.
Things get more complicated if you are changing the Schema Master, Domain Naming Master, or RID Master role. For these, you must use the Ntdsutil command-line utility. This utility is a powerful tool that has many uses. The help screen displaying the various options is shown in Figure 3.5 (along with the steps to seize a role, which are described in the following section).
)
Figure
3.5 Using the Ntdsutil utility to seize a role.
As you can see, the ntdsutil command has a host of options. The following steps walk you through seizing a role as well as how to get help with this utility at any time by using the help command:
-
Select Start, Run and then type ntdsutil. Click OK.
-
At the ntdsutil prompt, type roles and press Enter. For help, type help and press Enter. Depending on the prompt displayed at the time, help information is shown.
-
At the fsmo maintenance prompt, type connections and press Enter.
-
At the server connections prompt, type connect to server followed by the fully qualified domain name (FQDN) of the DC that will be seizing the role. Press Enter.
-
At the server connections prompt, type quit and press Enter.
-
At the fsmo maintenance prompt, type one of the following commands (depending on the role you are attempting to seize):
-
seize PDC
-
seize RID master
-
seize infrastructure master
-
seize schema master
-
seize domain naming master
-
At the fsmo maintenance prompt, type quit and press Enter.
-
At the ntdsutil prompt, type quit and Press Enter.
Press Enter.
Once you have completed the command, don't forget to verify that the role has changed by using the method outlined in the "Determining Operations Master Roles" section earlier in this chapter. Don't forget that once a role has been seized, the old server playing the role must never come online again.
NOTE
Ntdsutil has a host of options. Make sure you experiment with this tool. Also, don't forget to type help or ? at each prompt to see a display of available options.