In this free video from IT Free Training I will look at moving operational master roles
around in Active Directory. To start with, let’s start with the most basic setup and
that is one domain controller in one domain in one forest.
When you install your first domain controller in a new forest all five roles will be on
the first domain controller. Just to recap, at the forest level there are the two operation
master roles Domain naming master and schema master. At the domain level you have 3 roles
which are the RID master, PDC emulator and infrastructure master.
When you start adding more domain controllers to your domain you may want to move these
roles to different servers. Depending on your network layout and hardware will determine
where you move these roles to. In this video I will look at moving the operating
master roles from one domain controller to anther domain controller. In the next video
I will have a much closer look at which servers you would place these roles on depending on
the design of your network. In the next video I will also look at which domain controllers
you should make into global catalog servers. First of all I will look at how to transfer
the domain wide operational master roles. This is an easy task to perform using the
Active Directory users and computers tool. I will now change to my Windows Server 2008
domain controller to demonstrate how to achieve this.
First of all open Active Directory users and computers from administrative tools under
the start menu. To transfer or view which servers have domain operation master roles,
right click the domain and select operations master.
From here you have 3 tabs one for each of the 3 domain operation masters roles. These
are RID, PDC and infrastructure. Once you select the tab for the operational master
role that you want to work with, in this case the Infrastructure master role, at the top
it will show the current domain controller that has that role.
At the bottom is the domain controller that the operational master role will be transferred
to. Since I am connected to the same domain controller that is holding the role, when
I press the change button I will get an error message telling me I must connect to the domain
controller that I want to transfer the role to.
To connect to a different domain controller, go back Active Directory users and computers
and once again right click on the domain but this time select the option change domain
controller. This will show you all the domain controllers in your domain, it is just a matter
of selecting the one you want to transfer the role to and press o.k.
Now that I have changed to a different domain controller, if I once again right click the
domain and select the option operations masters. This time the operation master role is listed
as DC1 and below this is listed DC2. DC2 is the domain controller that I am connected
to and thus the domain controller the role will be transferred to.
Once I press the change button, Windows will confirm the role will be transferred and then
I will receive a confirmation message that the role was transferred. When I press o.k.
DC2 is now listed as holding the RID operational master role.
In this case I transferred the RID operational master role but the procedure is the same
for the PDC and infrastructure master roles. This covers the 3 domain wide roles, now let’s
have a look at the two forest wide roles. To recap there are two forest wide operation
master roles, these are the domain naming master and the schema master. These roles
aren’t used that much so Microsoft recommends leaving them on the same server for ease of
administration. If the network is expanded to a multi domain
environment, normally the schema and domain naming master roles will be located in the
root or parent domain. You can transfer these roles to any domain controller in the forest
so you could transfer them to the child domain like this if you wanted to.
Transferring the domain naming master is a simpler process as to transferring a domain
operational master role. The only difference is that you use the tool Active Directory
domains and trusts rather than Active Directory users and computers. To demonstrate this,
I will change to my Windows Server 2008 computer and run Active Directory domains and trusts
from the start menu. Just like the domain wide roles, you need
to right click the domain and select operation master. This will show you where the domain
naming master is located. Just like the domain wide roles I need to once again right click
the domain and select the option change Active Directory domain controller to the domain
controller that I want to transfer the role to.
Once I have selected my domain controller it is a simple matter of selecting operation
master and pressing the change button. Once you have confirmed that you want to move the
role the domain naming role will be moved. The last operation master role I will look
at is the forest wide schema master. The process of moving the role is much the same as the
process of moving the other roles however the tool to move the role this is not available
by default. The tool required is the Active Directory
schema snap in. To make this tool available you need to run the following command to register
a dll required by the snap in. To do this, if I go back to my Windows Server 2008 computer
and open a command prompt I can run the command reg svr 32 with the dll name.
Windows will give you a message to let you know the dll was registered. There is no
shortcut in the start menu to run the tool, so I will run mmc from the start menu. The
administrative tools that Windows uses are called snap in’s. This is because you can
run mmc and add or subtract any snap-in that you want. It is not uncommon for administrators
to add all their favorite tools into mmc and then save the configuration of mcc.
Once the configuration is saved, they can load this configuration at any time with all
their favorite tools pre-loaded. In this case I will add the snap in Active
Directory schema. It is now available because I registered the dll. Like Active Directory
users and computers and domains and trusts I need to connect to the domain controller
that I want to transfer the role to. Once connected, I can once again select the operation
master and then select the change button to transfer the role.
Using each of the different tools you can see which domain controller holds each role
as well as move the roles from domain controller to domain controller. Windows also comes with
a command line tool that can be used to find out which domain controller has which roles
called dcdaig. If you run this command with slash test colin
followed by “knows of roles holders” this will tell you which domain controller have
which roles. I have added the slash v switch for verbose to give us additional information.
If I scroll up, listed here are all the five operation master roles and which domain controllers
they are currently located on. This concludes how to move operation master
roles around in Active Directory. In the next video I will look into more detail about which
domain controllers you should put these roles on and also which domain controllers you should
make global catalog servers. Once again, thanks for watching.