What are the FSMO roles in Windows 2000?

A. In Windows 2000, all domain controllers (DCs) are equal. Changes replicate to all the DCs in a domain through a process known as multimaster replication. Multimaster replication resolves conflicts.

In some situations, preventing conflicts is preferable. Five Flexible Single-Master Operation (FSMO) roles, formerly known as Floating Single-Master Operation roles, manage an aspect of the domain or forest, to prevent conflicts. You can manually move these roles between DCs.

Two types of roles exist: domain and forest. Only a DC in the domain can hold a domain-specific FSMO role, whereas any DC in the forest can hold a forest FSMO role. DCs can’t hold FSMO roles in other domains or forests.

You can use the Ntdsutil utility or one of several GUI methods to assign FSMO roles. The following table summarizes each role.

Role Name	Description	Per Domain or Forest
Domain Naming Master	If you want to add a domain to a forest, the domain’s name must be verifiably unique. The forest’s Domain Naming Master FSMOs authorize the domain name operation.	One per forest
Infrastructure Master	When a user and group are in different domains, a lag can exist between changes to the user (e.g., a name change) and the user’s display in the group. The Infrastructure Master of the group’s domain fixes the group-to-user reference to reflect the change. The Infrastructure Master performs its fixes locally and relies on replication to bring all other replicas of the domain up to date.	One per domain
PDC Emulator	For backward compatibility, one DC in each Win2K domain must emulate a PDC for the benefit of Windows NT 4.0 and NT 3.5 DCs and clients.	One per domain
RID Master	Any DC can create new objects (e.g., users, groups, computer accounts). However, after creating 512 user objects, a DC must contact the domain’s Relative Identifier (RID) Master for another 512 RIDs. (A DC actually contacts the RID Master when the DC has fewer than 100 RIDs left. Thus, the RID Master can be unavailable for short periods of time without causing object creation problems.) This procedure ensures that each object has a unique RID. When a DC creates a security principal object, the DC attaches a unique SID to the object. The SID consists of the domain SID and a RID. The RID Master must be available for you to use the Microsoft Windows 2000 Resource Kit’s Movetree utility to move objects between domains.	One per domain
Schema Master	At the heart of Active Directory (AD) is the schema, which is like a blueprint of all objects and containers. Because the schema must be the same throughout the forest, only one machine can authorize schema modifications.	One per forest

Even in native mode, the PDC Emulator has the following special roles.

Failed authentication requests
For downlevel clients who issue a change (e.g., a password change) that would normally go to the PDC in an NT4.0 domain
Focus of best-effort push of password changes an account lockouts
In cases in which a time server client contacts the DC, the DC contacts the PDC Emulator, and the PDC Emulator contacts the PDC one level up, the PDC Emulator root domain could use Simple Network Time Protocol (SNTP) to contact an atomic Internet clock
Focus of group policies: If you edit or create a group policy, you contact the PDC; if the PDC isn't available, you can select another DC

End of Article

This FSMO role was very useful for me to get practise in the Net

John2k_in@rediffmail.com

Anonymous User June 01, 2005 (Article Rating:

)

You must be a registered user or online subscriber to comment on this article. Please log on before posting a comment. Are you a new visitor? Register now