News

Powershell to seize FSMO roles

Sometimes one of Microsoft's 'single point of failure' problems bites back, and a dead DC which was housing the 5 FSMO roles is one of the most irksome. The obvious solution is to restore a working backup, but sometimes that might not be immediately possible - dead hardware, corrupt backup, need to get it working 'right now' and so on.

Assuming [!] one has other DCs available, then this bit of Powershell will force the FSMO roles to a new DC. 

$fsmoRoles = @('SchemaMaster','DomainNamingMaster','InfrastructureMaster','PDCEmulator','RIDMaster' )
$targetDC = Get-ADDomainController -Identity FQDN-of-dead-DC 
Move-ADDirectoryServerOperationMasterRole ` -Identity $targetDC ` -OperationMasterRole $fsmoRoles ` -Confirm:$false ` -WhatIf

 

Note the '- WhatIf' flag which shows what would happen but does not actually execute it, so it returns this:

What if: Moves the specified operation master (FSMO) role to the specified directory server.
What if: Moves the specified operation master (FSMO) role to the specified directory server.
What if: Moves the specified operation master (FSMO) role to the specified directory server.
What if: Moves the specified operation master (FSMO) role to the specified directory server.
What if: Moves the specified operation master (FSMO) role to the specified directory server.

PS C:WINDOWSsystem32> 

If you are happy with this then replace the -WhatIf with a -Force, and then execute the command.

Test for the correct migration of all FSMO roles with

Get-ADDomainController -Filter * | Select-Object ` HostName, Site, OperatingSystem

and

dsquery server -forest

Finally, clean up the debris.. 

Delete the old DC from ADSS

Delete any old DNS records

Run dcdiag /v /fix to fix any remaining errors.

See also..

<< Go back to the previous page