Recipe15.18.Finding the FSMO Role Holders


Recipe 15.18. Finding the FSMO Role Holders

Problem

You want to find the domain controllers that are acting as one of the FSMO role holders.

Solution

Using a graphical user interface

For the Schema Master:

  1. Open the Active Directory Schema snap-in.

  2. Right-click on Active Directory Schema in the left pane and select Operations Master.

For the Domain Naming Master:

  1. Open the Active Directory Domains and Trusts snap-in.

  2. Right-click on Active Directory Domains and Trusts in the left pane and select Operations Master.

For the PDC Emulator, RID Master, and Infrastructure Master:

  1. Open the Active Directory Users and Computers snap-in.

  2. Make sure you've targeted the correct domain.

  3. Right-click on Active Directory Users and Computers in the left pane and select Operations Master.

  4. There are individual tabs for the PDC, RID, and Infrastructure roles.

Using a command-line interface

In the following command, you can leave out the /Domain <DomainDNSName> option to query the domain in which you are currently logged on:

> netdom query fsmo /Domain:<DomainDNSName>

You can also use the dsquery server command to list the FSMO role owners as shown here where <Role> can be schema, name, infr, pdc, or rid:

> dsquery server -hasfsmo <Role>

Using VBScript
' This code prints the FSMO role owners for the specified domain. ' ------ SCRIPT CONFIGURATION ------ strDomain = "<DomainDNSName>"  ' e.g., emea.rallencorp.com ' ------ END CONFIGURATION ---------     set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE") strDomainDN  = objRootDSE.Get("defaultNamingContext") strSchemaDN = objRootDSE.Get("schemaNamingContext") strConfigDN = objRootDSE.Get("configurationNamingContext")     ' PDC Emulator set objPDCFsmo = GetObject("LDAP://" & strDomainDN) Wscript.Echo "PDC Emulator: " & objPDCFsmo.fsmoroleowner     ' RID Master set objRIDFsmo = GetObject("LDAP://cn=RID Manager$,cn=system," & strDomainDN) Wscript.Echo "RID Master: " & objRIDFsmo.fsmoroleowner     ' Schema Master set objSchemaFsmo = GetObject("LDAP://" & strSchemaDN) Wscript.Echo "Schema Master: " & objSchemaFsmo.fsmoroleowner     ' Infrastructure Master set objInfraFsmo = GetObject("LDAP://cn=Infrastructure," & strDomainDN) Wscript.Echo "Infrastructure Master: " & objInfraFsmo.fsmoroleowner     ' Domain Naming Master set objDNFsmo = GetObject("LDAP://cn=Partitions," & strConfigDN) Wscript.Echo "Domain Naming Master: " & objDNFsmo.fsmoroleowner

Discussion

Several Active Directory operations are sensitive, such as updating the schema, and therefore need to be done on a single domain controller. Active Directory cannot guarantee the proper execution of these functions in a situation where they may be invoked from more than one DC. The FSMO mechanism is used to limit these functions to a single DC.

There are five designated FSMO roles that correspond to these sensitive functions. A FSMO role can apply either to an entire forest or to a specific domain. Each role is stored in the fSMORoleOwner attribute on various objects in Active Directory depending on the role. Table 15-3 lists FSMO roles:

Table 15-3. FSMO roles

Role

Description

fSMORoleOwner location

Domain- or forest-wide?

Schema

Processes schema updates

CN=Schema,CN=Configuration, <ForestDN>

Forest

Domain Naming

Processes the addition, removal, and renaming of domains

CN=Partitions,CN=Configuration, <ForestDN>

Forest

Infrastructure

Maintains references to objects in other domains

CN=Infrastructure,<DomainDN>

Domain

RID

Handles RID pool allocation for the domain controllers in a domain

CN=RidManager$, CN=System,<DomainDN>

Domain

PDC Emulator

Acts as the domain master browser and as the PDC for downlevel clients and Backup Domain Controllers (BDCs)

<DomainDN>

Domain


Using VBScript

If you want to get the DNS name for each FSMO, you'll need to get the parent object of the ntdSDSA object and use the dNSHostName attribute. The code for getting the Schema Master could be changed to the following to retrieve the DNS name of the DC:

set objSchemaFsmo = GetObject("LDAP://cn=Schema,cn=Configuration," & strForestDN) set objSchemaFsmoNTDS = GetObject("LDAP://" & objSchemaFsmo.fsmoroleowner) set objSchemaFsmoServer = GetObject(objSchemaFsmoNTDS.Parent) Wscript.Echo "Schema Master: " & objSchemaFsmoServer.Get("dNSHostName")

See Also

MS KB 197132 (Windows 2000 Active Directory FSMO Roles), MS KB 223346 (FSMO Placement and Optimization on Windows 2000 Domain Controllers), MS KB 234790 (HOW TO: Find Servers That Hold Flexible Single Master Operations Roles), and MS KB 324801 (HOW TO: View and Transfer FSMO Roles in Windows Server 2003)



Windows Server Cookbook
Windows Server Cookbook for Windows Server 2003 and Windows 2000
ISBN: 0596006330
EAN: 2147483647
Year: 2006
Pages: 380
Authors: Robbie Allen

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net