Sunday, July 6, 2008

Best Practices for FSMO role placement:

In an Active Directory environment, some of your domain controllers (DCs) must be assigned certain special roles for your network to function properly. These special roles are called flexible single master operations (FSMO) roles, and DCs that hold such roles are called FSMO role holders. If you don't assign these roles properly, bad things can happen, so the focus of this article is on rules for proper placement of FSMO roles on AD-based networks. But before we proceed, please refer my blog session on FSMO roles.

Symptoms of FSMO Problems:

If one or more of your FSMO role holders has problems, bad things can happen. To help you troubleshoot such situations, the table below describes some of the symptoms that can occur when FSMO role holders go missing or don't work properly.

Symptom:

  1. PDC Emulator
    1. Users can't log on - If system clocks become unsynchronized, Kerberos may fail.
    2. Can't change passwords - Password changes need this role holder.
    3. Account lockout not working - Account lockout enforcement needs this role holder.
    4. Can't raise the functional level for a domain - This role holder must be available when the raising the domain functional level.
  2. RID Master
    1. Can't create new users or groups - RID pool has been depleted.
  3. Infrastructure Master
    1. Problems with universal group memberships - Cross-domain object references need this role holder.
  4. Domain Naming Master
    1. Can't add or remove a domain - Changes to the namespace need this role holder.
    2. Can't promote or demote a DC - Changes to the namespace need this role holder.
  5. Schema Master
    1. Can't modify the schema - Changes to the schema need this role holder.
    2. Can't raise the functional level for the forest - This role holder must be available when the raising the forest functional level.

Rules for FSMO Role Placement

Since FSMO roles are crucial for the proper functioning of an AD-based network, it's a good idea to get them right from the planning stage of your deployment. By default, when you install the first DC of your forest root domain, this first DC holds all five FSMO roles. When you install the first DC of any other domain in your forest, that DC will hold all three domain FSMO roles (PDC Emulator, RID Master, and Infrastructure Master). Depending on the complexity of your network, this FSMO role must be placed.

Rule 1: The PDC Emulator and RID Master roles should be on the same machine because the PDC Emulator is a large consumer of RIDs.

Tip: Since the PDC Emulator is the role that does the most work by far of any FSMO role, if the machine holding the PDC Emulator role is heavily utilized then move this role and the RID Master role to a different DC, preferable not a global catalog server (GC) since those are often heavily used also.

Rule 2: The Infrastructure Master should not be placed on a GC.

Tip: Make sure the Infrastructure Master has a GC in the same site as a direct replication partner.

Exception 1: It's OK to put the Infrastructure Master on a GC if your forest has only one domain.

Exception 2: It's OK to put the Infrastructure Master on a GC if every DC in your forest has the GC.

Rule 3: For simpler management, the Schema Master and Domain Naming Master can be on the same machine, which should also be a GC.

Exception: If you've raised your forest functional level to Windows Server 2003, the Domain Naming Master doesn't need to be on a GC, but it should at least be a direct replication partner with a GC in the same site.

Rule 4: Proactively check from time to time to confirm that all FSMO roles are available or write a script to do this automatically.

Tip: If any FSMO role holders at a remote site are unavailable, check first to see if your WAN link is down.

Hope the above is informative.

Please feel free to contact me for any questions.

Thanks

Logu

Logu_microsoft@hotmail.com

91-98414 99143.

15 comments:

Anonymous said...

This is very interesting, You are a very skilled blogger.

I've joined your feed and look forward to seeking more of your great post. Also, I've shared your web site in my social networks!


Feel free to surf to my page :: bankruptcy laws in florida

Anonymous said...

I think the admin of this website is really working hard for his site, for the
reason that here every material is quality based data.


Here is my web page; Calorie burn Calculator

Anonymous said...

This is a topic that is close to my heart... Many thanks!
Where are your contact details though?

Feel free to visit my weblog :: bmi calculator female

Anonymous said...

Males usually objectify ladies but ladies are significantly less most likely to perform exactly the same to males.
Women are far more psychological although males are less most
likely to become as emotional. What would be the basic psychological differences among women
and men, because given that they are each human
beings they must be same?

Feel free to visit my web-site: how to get a girl to like you

Anonymous said...

Dre give it up they may be bunch dc lovers superman is gay!


my weblog; keni the cane superman stamina free download

Anonymous said...

It is perfect time to make some plans for the future and it's time to be happy. I have read this post and if I could I wish to suggest you few interesting things or suggestions. Maybe you could write next articles referring to this article. I want to read even more things about it!

My blog ... new payday lenders

Anonymous said...

Hello everybody, here every one is sharing such experience, thus it's pleasant to read this blog, and I used to pay a quick visit this blog everyday.

Look into my blog ... fast cash loans

Anonymous said...

I’m not that much of a internet reader to be honest
but your sites really nice, keep it up! I'll go ahead and bookmark your site to come back later on. Cheers

Here is my web-site; www.wigsinlondon.co.uk

Anonymous said...

I genuinely favored the post. Bellas look essentially the most attractive.

Im spanish (numerous say i appear italian )but i want to
marry an italian. What aress in so cal will be the most intensely italian?
I want to understand exactly where to discover my treasure at.
Also-what are a number of the very best strategies to acquire an italian womans heart?
What's that you want from the man as a way to be insane about him. I like a sturdy lady who wants to be jealous because, you preserve the issues you enjoy one of the most closest. to you. I want a lady who's a top notch mom as
something much less is unacceptable to me. I

Also visit my web-site: ways to attract women

Anonymous said...

A timely & lively reminder in the persuasive, liberating and transforming power of music.
And I might add, we overrate mathematics in education and tragically?
underrate music within a child's development.

My site best premature ejaculation cures

Anonymous said...

Hello, i believе thаt i saw you visiteԁ my
blog thus i саme to go back the fаνoг?
.I аm attеmpting tο tο find things to enhancе
my web site!I guess its ok to mаke use
оf some of уour іdeas!!

Ηerе is mу hοmepage: skip hire Hertfordshire

Anonymous said...

I do not know whether it's just me or if perhaps everybody else experiencing issues with your blog.
It seems lije some of thhe text on your content are running off the screen.

Cann somebody else please comment and leet me know if this is happening to them
too? This could be a problem wwith my internet browser because I've had this happen previously.
Than you

Here is my weeb page ... voyance gratuite

Anonymous said...

What i do not realize is if truth be told how you are no longer really a lot
more neatly-preferred than you might be now. You are very intelligent.
You recognize thus considerably in terms of this matter, made
me individually imagine it from numerous varied angles.
Its like men and women are not fascinated unless it is something to do with
Woman gaga! Your individual stuffs nice. At all times maintain it up!


my page Native Spanish Tutors

Anonymous said...

I am actually delighted to glance at this blog posts which contains lots of valuable facts, thanks
for providing such information.

Also visit my site; Buy Steroids

Anonymous said...

You can save your invoices as a PDF file and send them conveniently
via email to expedite payments to you. Known for their
irregular work schedules, restaurants continually
change employee shifts to meet the needs of a demanding
public. It offers the most secure and safest way of processing credit card transactions.


Feel free to surf to my website: hotschedules login