How Can the User Find an FSMO Master?

Basically, in Active Directory-based domains (Windows 2000 and Windows .NET), there are five FSMO roles, and every forest contains at least five Active Directory objects, which "know" the names of these operations' masters. Windows .NET domains support application directory partitions, and each created partition has its own Infrastructure Master. Thus, the total number of operation masters in a single domain forest can exceed five. In addition, every new domain in the forest introduces three operation masters within that domain, since the PDC, RID, and Infrastructure FSMO roles are specific to each domain.

You can easily find all operation masters in a forest by using Ldp.exe. Make a synchronous search with the following parameters:

  • Base DN — the forest root distinguished name

  • FilterfSMORoleOwner=*

  • ScopeSubtree

  • AttributesobjectClass

  • Chase referrals — on

The results — the distinguished names of the objects as well as their types — must be similar to those shown in Table 17.2. The table contains an example of application partition —

Table 17.2: Active Directory Objects that Hold Information about the FSMO Masters

Object's distinguished name


PDC FSMO master



RID FSMO master

CN=RID Manager$,CN=System,DC=net,DC=dom


Infrastructure FSMO master



CN=Infrastructure,DC=ForestDnsZones,DC=net, DC=dom


Domain Naming FSMO master



Schema FSMO master




It is possible to use other tools, or to retrieve this information programmatically, for example, by making a search using ADO queries. (Specify the filter and an object class shown in Table 17.2.) You can simply display data on the screen or use them in your scripts or programs.

The fSMORoleOwner attribute (syntax DN) of each found object holds the distinguished name of the DSA (an object of the nTDSDSA class) that possesses the appropriate FSMO role. Here is an example of such a name (the elements that will retain their names in all Active Directory installations are in bold):

    CN=NTDS Settings, CN=NETDC1,CN=Servers,CN=NET-Site,CN=Sites,     CN=Configuration, DC=net, DC=dom 

You can bind to a specific DSA and ask for its parent object (by using the Parent method) — this will be the ADsPath of the server that holds the appropriate FSMO role (see Listing 17.25).

Windows  .NET Domains & Active Directory
Windows .NET Server 2003 Domains & Active Directory
ISBN: 1931769001
EAN: 2147483647
Year: 2002
Pages: 154 © 2008-2017.
If you may any questions please contact us: