Consider an enterprise with multiple Domain Controllers (DC). A multi-master enabled database like Windows Active Directory (AD), allows to update changes to any DC in the enterprise. But, in this case there are chances/ possibilities of conflicts which may lead to problems. As AD role is not bound to a single DC, it is referred as a Flexible Single Master Operation (FSMO) role. Currently in Windows there are 5 FSMO roles. These roles prevent conflict operations and are vital for handling the smooth operation of AD as a multi-master system. Out of the 5 FSMO roles, there are 2 forest wide roles per forest and 3 domain wide roles in each domain.
Forest wide roles
-Schema master : controls all updates and modifications to the schema (eg : changes to attributes of an object).
-Domain naming master : responsible while adding or removing a domain in a forest.
Domain wide roles
-RID master : allocates Relative IDs (RID) to DCs within a domain. When an object is created it will have an SID, which contains a domain SID (same for all SIDs created in the domain) and RID which is unique to the domain.
-PDC emulator : responsible for time sync, password changes etc.
-Infrastructure master : responsible for updating references from objects in its domain to objects in other domains. Infrastructure master role should not be on the same DC that is hosting the Global Catalogue (GC), unless there is only one DC in a domain. If they are on the same server, infrastructure master will not function, it will never find data that is out of date and so will never replicate changes to other DCs in a domain. If all DCs in the domain hosts a GC, then it doesn't matter which DC has the infrastructure master role as all DCs will be up to date due to the GC.
If you want to transfer FSMO roles from one DC to another, you can follow the below steps.
 |
| To check current FSMO status |
 |
| Steps before role transfer |
Use ntdsutil to transfer the roles. You have to connect to the server to which you want to transfer the role. Above screenshot explains this whole process.
 |
| Transfer roles |
Click Yes to transfer the role and then transfer all roles one by one.
 |
| FSMO status after role transfer |
Now all roles are moved from INVLABSDC02 to INVLABSDC01.
