How can I find the current FSMO role holders in a domain/forest?

A. The five Flexible Single Master of Operation (FSMO) roles are Schema master, Domain naming master, Relative Identifier (RID) master, PDC master, and Infrastructure master. In FAQs earlier this year, I explained how to change each of these roles in the following FAQs:

How can I change the Schema master FSMO?
How can I change the Domain naming master FSMO?
How can I change the RID master FSMO?
How can I change the PDC emulator FSMO?
How can I change the Infrastructure master FSMO?

You can use a GUI to find the FSMO role holders, but you need to perform several sets of steps (for this approach, see Microsoft article Q234790.

However, you can use some other approaches to reduce the number of steps that the GUI requires to find the current FSMO role holders. First, you can use the command file dumpfsmos.cmd from the Win2K Server Resource Kit. This command uses the built-in ntdsutil.exe, which shows you all the FSMO role owners.

To find the current FSMO role holders, you simply execute the dumpfsmos command on a domain. For example, you could type the following command:

C:\>dumpfsmos.cmd savilltech.com
When the following information appears on the screen, find the line that reads "Server 'savilltech.com' knows about 5 roles," and read the lines below it to find information about each FSMO role holder.

Ntdsutil: roles fsmo maintenance: Connections server connections: Connect to server savilltech.com Binding to savilltech.com ... Connected to savilltech.com using credentials of locally logged on user server connections: Quit fsmo maintenance: select Operation Target select operation target: List roles for connected server Server "savilltech.com" knows about 5 roles Schema - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First- Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First- Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-Site- Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-Site- Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default- First-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com select operation target: Quit fsmo maintenance: Quit Ntdsutil: Quit Disconnecting from savilltech.com ...

You can also manually execute the ntdsutil.exe tool by performing the following steps:

Click Start, Run. Type cmd in the Open box, and press Enter.
Type ntdsutil, and press Enter.
Type domain management, and press Enter.
Type connections, and press Enter.
Type connect to server [server name], and press Enter.
Type quit, and press Enter.
Type select operation target, and press Enter.
Type list roles for connected server, and then press Enter.

Sample output from the command appears below with the text you type shown in boldface type. Below the line that reads "Server 'titanic-dc' knows about 5 roles," you'll find information about your FSMO role holders.

C:\>ntdsutil ntdsutil: domain management domain management: connections server connections: connect to server titanic-dc Binding to titanic-dc ... Connected to titanic-dc using credentials of locally logged on user server connections: quit domain management: select operation target select operation target: list roles for connected server Server "titanic-dc" knows about 5 roles Schema - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First- Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com Domain - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First- Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com PDC - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-Site- Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com RID - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-Site- Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com Infrastructure - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default- First-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com select operation target: quit domain management: quit ntdsutil: quit Disconnecting from titanic-dc ...

A third option for finding the current FSMO role holders is to use the dcdiag utility, which you can find in the Support/Tools folder of the Win2K Support Tools. To use the dcdiag utility, type the following command:

G:\>dcdiag /test:Knowsofroleholders /v

Sample output for the command appears below. You'll find information about your FSMO role holders below the line that reads "Starting test: KnowsOfRoleHolders."

DC Diagnosis Performing initial setup: * Verifing that the local machine titanic-dc, is a DC. * Connecting to directory service on server titanic-dc. * Collecting site info. * Identifying all servers. * Found 1 DC(s). Testing 1 of them. Done gathering initial info. Doing initial non skippeable tests Testing server: Default-First-Site-Name\TITANIC-DC Starting test: Connectivity * Active Directory LDAP Services Check * Active Directory RPC Services Check ......................... TITANIC-DC passed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\TITANIC-DC Test omitted by user request: Replications Test omitted by user request: Topology Test omitted by user request: CutoffServers Test omitted by user request: NCSecDesc Test omitted by user request: NetLogons Test omitted by user request: Advertising Starting test: KnowsOfRoleHolders Role Schema Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Defaul t-First-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com Role Domain Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Defaul t-First-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com Role PDC Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-F irst-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com Role Rid Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-F irst-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com Role Infrastructure Update Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Se rvers,CN=Default-First-Site- Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com ......................... TITANIC-DC passed test KnowsOfRoleHolders Test omitted by user request: RidManager Test omitted by user request: MachineAccount Test omitted by user request: Services Test omitted by user request: OutboundSecureChannels Test omitted by user request: ObjectsReplicated Test omitted by user request: frssysvol Test omitted by user request: kccevent Test omitted by user request: systemlog Running enterprise tests on : savilltech.com Test omitted by user request: Intersite Test omitted by user request: FsmoCheck

End of Article