Good day, Cloud Gurus, and welcome back.
In this lesson, we're going to explore
the Flexible Single Master Operations Roles,
more commonly referred to as the FSMO roles.
And we'll also take a look at the Global Catalog.
Let's take a look at what we're going to cover.
First up, we'll answer the question,
what is the Global Catalog?
And we've already taken a little bit of a look
at the Global Catalog,
but we'll dive a little bit deeper into it in this lesson.
And then we'll take a look
at what the operations masters are.
And then finally, we'll do a demo
where we will identify the operations masters
and transfer and seize them.
All right, let's get started.
So what is the Global Catalog?
Well, the Global Catalog is a partial,
read-only searchable copy of all of the objects
in an Active Directory forest.
It helps speed up searches for objects that might be stored
on domain controllers in different domains.
Now in years past, you had to carefully consider
the placement of your Global Catalog servers.
But these days, network bandwidth
is generally high enough that you can make
all of your domain controllers Global Catalogs.
But if you have network constraints
that mean that you can't make
all of your domain controllers a Global Catalog,
just be sure that you don't place the Global Catalog
on the infrastructure master operations role.
And we'll cover the infrastructure master
in more detail in just a moment.
But regardless of where you choose
to place your Global Catalogs,
if you don't make every domain controller a Global Catalog,
you should place at least one Global Catalog
in each Active Directory site.
All right, let's take a look at the operations masters.
Previously, we mentioned that the Active Directory database
can be written to by all domain controllers,
but some functionality isn't well suited to that.
And that's where the operations master roles come in.
Now there are 2 forest-level operations masters.
And there is just one
of each of these operations master per forest.
The first forest-level operations master
is the schema master,
and it's used to introduce schema changes
and it must be online when schema changes are made.
And you need to be a member of the Schema Admins group
to manage the schema master operations role.
The other forest-level operations master
is the domain naming master.
And it's required when you add
or remove domains from the forest.
And it's also required if you add or remove
application partitions.
And it must be online when you're adding
or removing domains or partitions.
And there are 3 domain-level operations masters.
And there is one of each
of these operations masters per domain.
The first is the RID master
and it allocates relative identifier pools
to new and existing domain controllers.
And Relative Identifiers
are used by domain controllers
to generate unique security identifiers
for each account in the domain.
And every single object in the forest
has a unique security identifier,
more commonly referred to as a SID.
And then we have the infrastructure master.
And it operates cross-domain references
from the Global Catalog.
One infrastructure master is required
per application partition,
and the infrastructure master becomes irrelevant
if all domain controllers are Global Catalogs.
And then finally, we have the PDC emulator
and it receives updates when passwords are changed
for users and computers.
And it also is communicated with for mismatched passwords,
and it's also the default Group Policy target.
And the PDC emulator is perhaps the most important
of all the operations masters
and it should be online 24/7.
All right, now let's take a look at the default placement
of the Flexible Single Master Operations Roles.
The forest-level operations master roles
are placed on the first domain controller in the forest.
And that includes the schema master
and the domain naming master,
and the 3 domain level operations masters
including the RID master,
infrastructure master, and PDC emulator.
But as you deploy more domain controllers and more domains,
you will keep the forest operations masters
and you'll get new domain-level operations masters
for each domain you add.
Now you can move the operations masters
anywhere in the forest,
and this process is known
as transferring an operations master.
But what happens if one of those domain controllers fails?
Well, then you can perform
what's known as seizing an operations master role.
Now let's take a look at a demo where we will identify
the operations masters using both the command line
and graphical management tools,
and then we will transfer and seize the roles
using those tools.
We have 2 domain controllers
and our administrative server, ADM01.
And we will use the administrative tools on ADM01
to perform these tasks.
Let's take a look.
So here we are on our administrative server.
Let's use the command line to identify
the current operations masters,
and there are 2 ways you can do this.
You can use the NetDom command-line tool
or you can use PowerShell.
Let's take a look at the NetDom command-line tool first.
We'll launch PowerShell.
And then the command to identify the current
operations masters is netdom query fsmo.
And we can see here that all of the operations masters
are currently on our first domain controller.
Now let's identify the operations masters using PowerShell.
To identify the forest-level operations masters
using PowerShell,
we use the Get-ADForest cmdlet.
And we can see here that the cmdlet returns
a list of all of the Global Catalogs we have in the domain.
And it also returns the details
of the DomainNamingMaster and the SchemaMaster.
Now let's identify the domain-level
operations masters using PowerShell.
To do that, we use the Get-ADDomain PowerShell cmdlet.
We only have one Active Directory domain at present,
so let's have a look
at which of the operations masters that's identified.
We can see that it's identified the infrastructure master
and it's also identified the RID master
and the PDC emulator.
And they're all currently on domain controller one.
All right, now let's use the graphical administrative tools
to identify the operations masters. We'll minimize
PowerShell. To identify the domain naming master,
we use Active Directory Domains and Trusts
and then we can right-click the top node,
Active Directory Domains and Trusts,
and then select Operations Master.
And we can see here that DC01
is our current operation master.
We'll go ahead and close this.
Now identifying the schema master is a little more tricky
than the other operations masters.
To do that, we first need to register
the Schema Management Console.
To register the Schema Management Console,
we run the following command.
We'll go ahead and run that now.
Click OK.
All right, with the schema management DLL
successfully registered,
let's go ahead and use MMC
to add the Schema Management Console Snap-in.
So we'll run MMC and then we'll add
the Schema Management snap-in.
So we'll select File and then Add/Remove Snap-in,
and then we'll select Active Directory Schema.
And we'll click Add and then OK.
And then we'll expand that node,
and then we'll right-click
on the Active Directory Schema node
and then we'll select Operations Master.
And we can see here that DCO1
is the current operations master.
All right, let's go ahead and close this
and then we'll identify
the domain-level operations masters.
We'll close Schema Management,
and then we'll go ahead and use
Active Directory Users and Computers
to view the domain-level operations masters.
We'll right-click on the domain
and we'll select Operations Masters.
And we can see that we can identify the RID master,
PDC emulator, and infrastructure master.
All right, let's go ahead and move
some of the operations master roles to DC02.
We'll go ahead and close this
and then we need to change our domain controller to DC02.
So we'll right-click on the Domain
and then we'll select Change Domain Controller.
We'll change our domain controller to DC02,
select OK, and then we'll go back
into the Operations Masters.
And now let's move our infrastructure master to DC02.
We'll select the Infrastructure master tab
and then we'll select Change and then Yes to confirm.
And it's as easy as that.
The operations master has been transferred to DC02.
We'll select OK and then Close.
All right, now let's move the PDC emulator using PowerShell.
We'll launch PowerShell.
And to do that, we're going to use
a really long PowerShell cmdlet
called Move-ADDirectoryServerOperationMasterRole.
And then we'll go ahead and specify
which domain controller we want to move
the operations master to using the identity parameter.
And in our case, we're going to move it to DC02.
And then we'll specify which operation master role
we want to move.
And in our case, we want to move the PDC emulator,
and you can press Tab to complete these parameters
without having to type them in full.
And you can Tab to complete
the operations master role name as well.
And then we press Enter to move
that Active Directory operations master role.
Just asking us to confirm
that we want to move the PDCEmulator to DC02.
We'll go ahead and confirm that with Yes,
and then that successfully moved.
And now I'm going to simulate the failure of DC01
and then we'll take this opportunity
to seize some operations master roles.
So I'll come back once we've removed DC01 from the equation.
All right, now that DC01 is now
completely out of the picture,
it's worth pointing out that you should only
seize operations master roles as a last resort
and only if you are not able
to recover the domain controller
that is running the operations master role.
We're now going to assume we're in that position.
Let's use PowerShell to identify
which operations masters are still running on DC01.
And we're going to use the Get-ADForest PowerShell cmdlet
to identify the operations masters.
And I'm just going to pipe
the Get-ADForest PowerShell cmdlet
to the Select-Object PowerShell cmdlet
to filter out any of the properties
that don't include the word master.
And that will just reduce the number
of properties we get back
from the Get-ADForest PowerShell cmdlet.
So I'll go ahead and run that.
And you can see here that both the domain naming master
and the schema master are still running on DC01.
Now let's use the Get-ADDomain PowerShell cmdlet
to identify which domain-level operations masters
are still running on DC01.
And I'm just going to pipe that
to the Select-Object PowerShell cmdlet again
just to get any properties
that include the words master or PDC.
And that's just to tidy up the output
a little bit to make it easier for everyone to read.
And we can see here
that we still have the RID master running on DC01.
Let's go ahead and run that really long
Move-ADDirectoryServerOperationMaster cmdlet again,
but this time we're going to specify
the force parameter to
indicate that we want to seize the operations master roles.
So we'll run Move-ADDirectoryServerOperationMaster
and we'll use the identity parameter to specify
that we want to move these to DC02
and then we'll specify the operations master roles
that we want to seize.
And we want to seize the SchemaMaster,
DomainNamingMaster, and RIDMaster.
And then finally, we'll specify force to indicate
that we want to seize these roles.
So we'll go ahead and run that.
And now it's just confirming
if we want to move the operations master roles
I'm going to say Yes to All and then press Enter.
This will just take a moment,
so we'll come back when this is done.
All right, now that we've seized those roles,
let's run Get-ADForest one more time
to see if all of the forest-level operations masters
are running on DC02.
So we'll just press up to get back to our previous command
and then we'll press Enter.
And we can see that all of our forest-level
operations masters are running on DC02.
And now we'll run the Get-ADDomain PowerShell cmdlet
to see if all of our domain-level operations masters
are running on DC02.
All right, and that confirms
that all of our operations masters
are now running on DC02.
And that concludes this demo.
Let's go and wrap up with a bit of a summary
of what we've covered in this lesson.
All right, so what have we covered?
There are 2 forest level operations masters.
They are the schema master and the domain naming master.
And the schema master is required
when you're updating the schema.
And the domain naming master is required
when you're adding domains or directory partitions.
And there's also 3 domain-level operations masters
and they are the RID master, infrastructure master
and PDC emulator.
And the PDC emulator is the most critical
of the domain-level operations masters.
You can transfer operations master roles
or you can forcefully seize the roles if you need to
to move them between domain controllers.
All right, that concludes this lesson.
Thanks for being with me
And I hope you found it useful.
And I look forward to seeing you on the next lesson.