Which of the following is true of the infrastructure master active directory fsmo role?

Menu

FSMO Roles

FSMO roles are required for certain critical operations such changing a domain name or modifying the AD design schema. Such changes must be carefully coordinated across all DCs. One DC is designated as the “master” for all such critical operations, and all the other DCs must defer to the DC that holds the master role.

If your AD contains only a single domain then the Primary Domain Controller (PDC) will typically hold all of the FSMO roles. This is the most common case.

The Seven FSMO Roles

There are seven FSMO roles defined in Active Directory:

1. The Primary Domain Controller (PDC) emulator role, one per domain. The DC with this role coordinates changes to user passwords and secrets.
2. The Relative Identifier (RID) Master role, one per domain. The DC with this role allocates RIDs for newly created users and groups.
3. The Schema Master role, one per forest. The DC with this role coordinates adding new object classes to the AD design schema.
4. The Domain Naming Master role, one per forest. The DC with this role coordinates adding or deleting domains and renaming domains.
5. The Infrastructure Master role, one per domain. The DC with this role updates cross-domain references to renamed objects. (The Infrastructure Master role has special rules -- see below.)
6. The Domain DNS Zone Master role, one per domain. The DC with this role coordinates adding or deleting any AD-integrated DNS zones on the DCs with DNS servers that host the domain.
7. The Forest DNS Zone Master role, one per forest. The DC with this role coordinates adding or deleting the forest-wide records that list all DNS servers that host AD-integrated DNS zones.

To view which DCs own the FSMO roles, type the console command netdom query fsmo.

Verify that the DCs in your test network own the FSMO roles listed above and that at least one DC has the Global Catalog (GC).

Many AD books and websites describe five FSMO roles. There are actually seven. The two extra hidden roles are the Domain DNS Zone Master role and the Forest DNS Zone Master role. These two roles are not well documented and there is no way to display or transfer them without using advanced tools such as ADSIEdit.

U-Move will automatically display the ownership of these hidden roles, and it will offer to move them along with the other well-documented roles when you migrate AD to a new computer.

The Infrastructure Master role has special rules that must be considered when moving the role to another DC. (Don't worry if you do not understand this section. U-Move will automatically check the rules for you during the migration and advise you on how to proceed.)

The Infrastructure role should be held by a DC that is not a GC in the same domain. This is because the GC holds a partial replica of every object in the forest. The Infrastructure Master role must be held by a DC that is not a GC in the same domain so that it can identify and fix discrepancies between the GC and its own domain objects.

You can safely ignore the Infrastructure Master role if either of the following are true.

• If all of the DCs in the domain are also GCs (which is a common configuration for the DCs in the forest root domain), or if none of the DCs in the domain are GCs (which is a common configuration for the DCs in other domains), then the Infrastructure Master role does not matter.
• You can disregard the Infrastructure Master role if you have enabled the Recycle Bin for the AD forest.

The all/none rule applies only to the DCs actually running. If, for example, you are testing AD changes in your lab then you will typically clone only a single DC to run your tests (the PDC) so the Infrastructure Master role does not matter.

If you are migrating AD, U-Move will automatically warn you if the Infrastructure Master role is not assigned correctly. The warning message will appear in the Replication Test Report.

For more information about FSMO roles see Understanding FSMO Roles in Active Directory (petri.co.il) and Active Directory FSMO roles in Windows (Microsoft Docs).

Active Directory (AD) is pretty much the go-to domain authentication services for enterprises all over the world and has been since its inception in Windows Server 2000.

Back then, AD was pretty unsecured and had some flaws that made it particularly difficult to use. For example, if you had multiple domain controllers (DCs), they would compete over permissions to make changes. This meant that you could be making changes and sometimes they simply wouldn’t go through.

What are FSMO roles in Active Directory

Over the last few decades, Microsoft has introduced numerous enhancements, patches, and updates that have drastically improved AD functionality, reliability, and security. One such change was to head towards a “single Master Model” for AD where one DC could make changes to the domain. The other DCs fulfilled automation requests.

However, people quickly realized that if the master DC goes down, no changes could be made at all until it was back up again. So, Microsoft had to rethink.

The solution they came up with was to separate the responsibilities of the DC into numerous roles. That way, if one of the DCs goes down, another can take over the missing role. This is known as Flexible Single Master Operation (also known as FSMO or FSMO Roles).

The 5 FSMO Roles

A full Active Directory system is split into five separate FSMO roles. Those 5 FSMO roles are as follows:

1. Relative ID (RID) Master
2. Primary Domain Controller (PDC) Emulator
3. Infrastructure Master
4. Domain Naming Master
5. Schema Master

Schema Masters and Domain Naming Masters are limited to one per forest, whereas the rest are limited to one per domain.

1. Relative ID (RID) Master

If you want to create a security principle you are probably going to want to add access permissions to it. You can’t grant these permissions based on the name of a user or group because that can change. Instead, you associate them with a unique security ID (SID). Part of that unique identifier is known as the relative ID (RID). To prevent two objects having the same SID, a RID Master processes RID pool requests from DCs within a single domain and ensures that each SID is unique.

2. Primary Domain Controller (PDC) Emulator

This is the most authoritative DC in the domain. The role of this DC is to respond to authentication requests, managed password changes and manages Group Policy Objects (GPO). Users cannot even change their passwords without the approval of the PDC Emulator. It’s a powerful position!

3. Infrastructure Master

This controller understands the overall IT infrastructure in the organization, including what objects are present. The infrastructure master updates object references at a local level and also makes sure that it is up to date in the copies of other domains. It does this through unique identifiers, such as SIDs.

4. Domain Naming Master

This DC simply ensures that you are not able to create a second domain in the same forest with the same name.

5. Schema Master

This DC holds a read-write copy of your AD schema. Schema is essentially all the attributes associated with an object (passwords, roles, designations, etc.). So, if you need to change a role on a user object, you’ll have to do it through the Schema Master.

FSMO Roles: Reliability and Availability

The 5 FSMO Roles are critically important as they go hand in hand with the security of your Active Directory. The domain controllers, therefore, need to be online at the time the services are needed. Thankfully, depending on the FSMO role, this may not be all that often. For schema master, for example, the DC only needs to be online during the update. The PDC, however, will need to be online and accessible at all time. For that reason, you need to make the necessary steps to ensure that the PDC emulator does not fall over.

If you find yourself in a scenario where one of the FSMO roles is unavailable (say, for example, the PDC emulator), you need to act quickly to get all your FSMO roles back up and running again. If you know that a particular FSMO role is going to undergo scheduled maintenance, you should transfer the FSMO role to a different DC. If the worst should occur, and your FSMO role crashes, you can always seize the FSMO role to another domain controller as a last resort.

Conclusion

It’s absolutely vital that you are proactively and continuously monitoring Active Directory changes in order to prevent insider threats, privilege abuse, and brute force attacks. Unsure about how to do this? Schedule a demo with one of our engineers today and see how Lepide Active Directory Auditor helps monitor and secure AD.

Monitor and Secure AD with Lepide Active Directory Auditor

What is the role of infrastructure master in FSMO?

What is FSMO role in Active Directory?

Which of the follow are the correct FSMO role names for Microsoft's Active Directory?

Which of the following tools can be used to move the infrastructure master role in Active Directory?