Placing Operations Master Roles

In organizations, we use roles and responsibilities to maintain different levels of accountability. With roles and responsibilities in place, everyone knows what they are supposed to do in their job. This applies to applications/services as well. Within application/services we have different roles. These roles are also associated with different sets of privileges. While one role has read-only permissions, another has permission to do system-wide configuration changes. This helps to maintain the integrity of the application/services.

Active Directory is built upon a multi-master database model. This means that any writable domain controller in the domain can change the Active Directory configuration and it will replicate to all other domain controllers. But there are some operations that need to be controlled in a sensible manner in order to maintain the integrity of Active Directory Domain Services (AD DS). These operations are better managed in...

FSMO roles

There are five FSMO roles in the Active Directory infrastructure. Each of the roles is responsible for performing specific Active Directory tasks that other domain controllers in the infrastructure are not permitted to perform. These five FSMO roles are divided into two categories based on their operation boundaries:

Forest level	Domain level
Schema operations master	The primary domain controller (PDC) emulator operations master
Domain-naming operations master	The relative identifier (RID) operations master
N/A	The infrastructure operations master

When we create the first Active...

Active Directory's logical and physical topology

If it's a single forest-single domain environment, it is not wrong to keep all the FSMO roles in one domain controller. According to the best practices, the infrastructure operations master role should not be held by a global catalog server. But, this is only if the environment has multiple domains. In a single forest-single domain environment, on most occasions, all servers are global catalog servers as well.

In the following example, in the rebeladmin.com single forest-single domain environment, there are three domain controllers in the infrastructure:

Figure 5.3: FSMO role placement example 1

PDC01 is recognized as the most powerful (capacity) and most reliable domain controller. Therefore, PDC01 holds all five FSMO roles. SDC01 and SDC02 are also two global catalog servers. In this case, just moving the infrastructure operations master role to one of the domain controllers will not have a significant impact...

Best practices

In previous sections, I have explained things we need to consider for FSMO role placement. Here, I'd like to summarize the points we discussed so far:

• Domain controllers in the forest should be able to reach FSMO role holders without any network layer connection barriers. If domain controllers are in a segmented network, make sure traffic is routed correctly.
• We can distribute FSMO roles to multiple servers; however, more servers means more management overhead. Unless it is a real requirement, try to keep FSMO roles to a fewer number of computers.
• Place the PDC role in the most reliable and powerful domain controller. Avoid installing applications and other Windows Server roles in PDC to reduce unnecessary resource usage.
• Keep the RID master and PDC roles in the same domain controller (same domain). Communication between these roles is crucial and keeping this in the same domain controller ensures reliable connectivity. Resource...

Moving FSMO roles

In the Active Directory setup, sometimes, FSMO roles will need to be moved from one domain controller to another. Here, I have listed a few scenarios where it will be necessary to consider FSMO roles transfers:

• Active Directory upgrades: When there is the requirement for an Active Directory upgrade, first we need to introduce the new domain controllers to the existing setup and then move the FSMO roles. After that, the domain controllers that run older versions can be decommissioned.
• Active Directory logical and physical topology: When installing the first domain controller in the infrastructure, it will automatically hold all five FSMO roles. But, based on the Active Directory topology design, the roles can be transferred to ideal locations, as discussed in the previous section. This can be based on the initial design or an extended design.
• Performance and reliability issues: FSMO role owners are responsible for specific tasks in an Active...

Seizing FSMO roles

In the previous section, I explained how to transfer FSMO roles from one domain controller to another. But there are certain situations where we will not be able to transfer the FSMO roles, such as the following:

• Hardware failures: If the domain controller that holds the FSMO roles failed due to hardware issues and there is no other way to bring it back online using a backup/DR solution, we need to use the seize method to recover FSMO roles
• System operation issues: If the domain controller has issues, such as operating system corruption, viruses, malware, or file corruption, it may not be allowed to transfer the FSMO role to another domain controller, which will also lead to an FSMO role seize
• Forcefully removed domain controller: If the FSMO role holder is forcefully decommissioned using the /forceremoval command, we need to use the seize method from any other available domain controller to recover FSMO roles

The FSMO role seize...

Summary

This is the end of another Active Directory infrastructure design chapter that was focused on FSMO role placements. FSMO roles are designated to do specific tasks in an Active Directory infrastructure in order to maintain integrity. In this chapter, you learned about FSMO roles and their responsibilities. Then, we moved on to FSMO role placement in the infrastructure, where you learned about techniques and best practices that need to be followed in order to maintain the best performance and availability. After that, we looked at how to transfer the FSMO roles from one domain controller to another using PowerShell, followed by a guide for seizing FSMO roles in the event of a disaster where you cannot recover the original FSMO role holder.

In the next chapter, we will look at actual Active Directory deployment scenarios and explore how to migrate from older versions of Active Directory to AD DS 2022.

The rest of the chapter is locked

Active Directory's logical and physical topology

If it's a single forest-single domain environment, it is not wrong to keep all the FSMO roles in one domain controller. According to the best practices, the infrastructure operations master role should not be held by a global catalog server. But, this is only if the environment has multiple domains. In a single forest-single domain environment, on most occasions, all servers are global catalog servers as well.

In the following example, in the rebeladmin.com single forest-single domain environment, there are three domain controllers in the infrastructure:

Figure 5.3: FSMO role placement example 1

PDC01 is recognized as the most powerful (capacity) and most reliable domain controller. Therefore, PDC01 holds all five FSMO roles. SDC01 and SDC02 are also two global catalog servers. In this case, just moving the infrastructure operations master role to one of the domain controllers will not have a significant impact...

Best practices

In previous sections, I have explained things we need to consider for FSMO role placement. Here, I'd like to summarize the points we discussed so far:

• Domain controllers in the forest should be able to reach FSMO role holders without any network layer connection barriers. If domain controllers are in a segmented network, make sure traffic is routed correctly.
• We can distribute FSMO roles to multiple servers; however, more servers means more management overhead. Unless it is a real requirement, try to keep FSMO roles to a fewer number of computers.
• Place the PDC role in the most reliable and powerful domain controller. Avoid installing applications and other Windows Server roles in PDC to reduce unnecessary resource usage.
• Keep the RID master and PDC roles in the same domain controller (same domain). Communication between these roles is crucial and keeping this in the same domain controller ensures reliable connectivity. Resource...

Moving FSMO roles

In the Active Directory setup, sometimes, FSMO roles will need to be moved from one domain controller to another. Here, I have listed a few scenarios where it will be necessary to consider FSMO roles transfers:

• Active Directory upgrades: When there is the requirement for an Active Directory upgrade, first we need to introduce the new domain controllers to the existing setup and then move the FSMO roles. After that, the domain controllers that run older versions can be decommissioned.
• Active Directory logical and physical topology: When installing the first domain controller in the infrastructure, it will automatically hold all five FSMO roles. But, based on the Active Directory topology design, the roles can be transferred to ideal locations, as discussed in the previous section. This can be based on the initial design or an extended design.
• Performance and reliability issues: FSMO role owners are responsible for specific tasks in an Active...

Seizing FSMO roles

In the previous section, I explained how to transfer FSMO roles from one domain controller to another. But there are certain situations where we will not be able to transfer the FSMO roles, such as the following:

• Hardware failures: If the domain controller that holds the FSMO roles failed due to hardware issues and there is no other way to bring it back online using a backup/DR solution, we need to use the seize method to recover FSMO roles
• System operation issues: If the domain controller has issues, such as operating system corruption, viruses, malware, or file corruption, it may not be allowed to transfer the FSMO role to another domain controller, which will also lead to an FSMO role seize
• Forcefully removed domain controller: If the FSMO role holder is forcefully decommissioned using the /forceremoval command, we need to use the seize method from any other available domain controller to recover FSMO roles

The FSMO role seize...

Summary

This is the end of another Active Directory infrastructure design chapter that was focused on FSMO role placements. FSMO roles are designated to do specific tasks in an Active Directory infrastructure in order to maintain integrity. In this chapter, you learned about FSMO roles and their responsibilities. Then, we moved on to FSMO role placement in the infrastructure, where you learned about techniques and best practices that need to be followed in order to maintain the best performance and availability. After that, we looked at how to transfer the FSMO roles from one domain controller to another using PowerShell, followed by a guide for seizing FSMO roles in the event of a disaster where you cannot recover the original FSMO role holder.

In the next chapter, we will look at actual Active Directory deployment scenarios and explore how to migrate from older versions of Active Directory to AD DS 2022.