Last part of this module is on troubleshooting flexible
single master operation or FSMO roles.
What FSMO roles are, are special capabilities of Active Directory domain
controllers. There are two forest‑wide ones where there's one domain
controller in the whole forest who holds that role, and then there are
three that are deployed per domain.
The Schema Master is the domain controller that's allowed to
perform updates to the Active Directory Schema.
All of these roles are initially placed on the first domain controller.
Now, this function,
the last bullet point on the right says generally placed on the forest root PDC.
PDC is an old historical reference to Primary Domain Controller.
It's going to be your first domain controller in that forest.
But the idea is that you can move Active Directory FSMO roles around for optimal
placement. Schema Master DC role holder, of course, you want to put extra
protection on because if you can modify the AD Schema,
you potentially could do great damage to your entire forest environment.
The other forest role is Domain Naming Master. Again,
this is one role holder for the whole forest, adds and removes domains and
application partitions, has to be online whenever you're doing work with
partitions or when you're working with domains. Domain‑specific FSMO
roles, PDC Emulator, the idea is that back in the Windows NT days, there
was only one read‑write domain controller, it was called the PDC or
Primary Domain Controller.
So the PDC Emulator role was originally created to support hybrid environments.
This is way back when in 2000/2001 when businesses were moving or migrating
from Windows NT domains to Windows Active Directory domains.
But nowadays, PDC Emulator still lives, it handles password changes,
that's the main one, and it's also responsible for group policy.
So the PDC Emulator absolutely has a critical role to play today.
The RID or RID Master, RID stands for Relative ID, this is what allows your
domain controllers to allocate security IDs. Every object that's created in a
domain needs to have a globally unique Security ID or SID. To avoid a domain
controller, if you have multiple domain controllers and you're creating
objects on those domain controllers,
you don't want them to hand out the same SID value, so we've got the
RID Master involved in partitioning the RID pool.
And lastly, we have Infrastructure Master, and this is just
looking at any references among domains and looking for references
to resources that span different domains.
So we've got connectivity between the Infrastructure
Master and the global catalog.
You absolutely never want to host the Global catalog and the
Infrastructure Master on the same box because you'll wind up
with kind of a routing loop.
The Infrastructure Master needs the global catalog for its updates and
the global catalog needs the Infrastructure Master for its updates, so
you want those on separate machines for sure.
Now the AZ‑800 objectives deal not with understanding what each
role is, that's kind of presumed. Like I say, this AZ‑800/AZ‑801
is not a beginner certification.
I'm not treating you as if you're brand new to Active Directory,
you have to come in with some existing skills.
The AZ‑800 asks specifically about how to transfer these roles for optimal
placement and/or for troubleshooting. In fact, troubleshooting, I think is specifically mentioned on the exam objective.