C:\Netdom Query
FSMO The 5 roles:
- Schema Master: Used to introduce manual and programmatic schema updates, and this includes those updates that are added by Windows ADPREP /FORESTPREP, by Microsoft Exchange, and by other applications that use Active Directory Domain Services (AD DS). - Must be online when schema updates are performed. (which in my case when I wanted to promote the new DC in to the existing domain it was unable because the DC was holding the Schema master was offline).
- Domain Naming Master: Used to add and to remove domains and application partitions to and from the forest. -Must be online when domains and application partitions in a forest are added or removed.
- Primary Domain Controller: Receives password updates when passwords are changed for the computer and for user accounts that are on replica domain controllers. -Consulted by replica domain controllers that service authentication requests that have mismatched passwords. -Default target domain controller for Group Policy updates. -Target domain controller for legacy applications that perform writable operations and for some admin tools. -Must be online and accessible 24 hours a day, seven days a week.
- RID: Allocates active and standby RID pools to replica domain controllers in the same domain. -Must be online for newly promoted domain controllers to obtain a local -RID pool that is required to advertise or when existing domain controllers have to update their current or standby RID pool allocation.
- Infrastructure Master: Updates cross-domain references and phantoms from the global catalog.
You can see that all masters are binding to the corrupted server and you cannot change the operation master since it could not be contacted.
What you can do is using ntdsutil command. (use this ref : http://www.vishalvasu.com/finding-fsmo-roles-using-ntdsutil/)
Step #1: On any Domain Controller, click Start. In the Run command type CMD and hit Enter. You will be taken to the good old command prompt window (DOS were the days). Type ntdsutil and hit Enter.
Step #2: You shall see the screen with ntdsutil: prompt. Since we want to find out the roles, type roles and hit Enter. Notice that the prompt now changes to show fsmo maintenance:. Now is a good time to get more HELP on the list of available commands.
Step #3: On the fsmo maintenance: prompt, type ? and hit Enter. Right-click in the Window, mark and copy them. Paste the clipboard in to Notepad for easy reference.
Step #4: Type connection and press Enter. This will show a prompt with server connections:. Type connect to server (replace and press Enter.
This table has the info:
FSMO
Role
|
Loss
implications
|
Schema
|
The
schema cannot be extended. However, in the short term no one will notice a
missing Schema Master unless you plan a schema upgrade during that time.
|
Domain
Naming
|
Unless
you are going to run DCPROMO, then you will not miss this FSMO role.
|
RID
|
Chances
are good that the existing DCs will have enough unused RIDs to last some
time, unless you're
building hundreds of users or computer object per week.
|
PDC
Emulator
|
Will be
missed soon. NT 4.0 BDCs will not be able to replicate, there will be no time
synchronization in the domain, you will probably not be able to change or
troubleshoot group policies and password changes will become a problem.
|
Infrastructure
|
Group
memberships may be incomplete. If you only have one domain, then there will
be no impact.
|
The following table summarizes the FSMO seizing restrictions:
FSMO
Role
|
Restrictions
|
Schema
|
Original
must be reinstalled
|
Domain
Naming
|
|
RID
|
|
PDC
Emulator
|
Can
transfer back to original
|
Infrastructure
|
Another consideration before performing the seize operation is the
administrator's group
membership, as this table lists:
FSMO
Role
|
Administrator
must be a member of
|
Schema
|
Schema
Admins
|
Domain
Naming
|
Enterprise
Admins
|
RID
|
Domain
Admins
|
PDC
Emulator
|
|
Infrastructure
|
To seize the FSMO roles by using Ntdsutil, follow these steps:
After done it.. you
can check again the Netdom Query FSMO already go to the connected server (Slave AD).
After that you have to delete/clear all the info for
offline/corrupted server (eg: probOldAD.contoso.com)
Remove AD
Then you can start installing AD for new server as below
step:
If you facing below warning... what you can check is if the is other network is enabled .
Solved: disable other network
No comments:
Post a Comment