PowerShell FSMO roles
Identify the affected role and recovery need before deciding to transfer or seize it.
Documentation: Microsoft Learn
Overview
Get-ADForest reports the two forest roles and Get-ADDomain reports the three domain roles. Capture the holder names and investigate the role involved in the failed operation. A role-holder outage does not make every directory operation fail in the same way.
For example, existing RID allocations can allow account creation to continue while the RID master is unavailable. Schema changes depend on the schema master. The PDC emulator has several responsibilities, so assess the actual symptoms and recovery requirements.
Transfer a role when the current holder is available and an orderly move is possible. Seizure is a recovery decision for an unavailable holder; the cmdlet’s Force option can attempt a transfer before seizing. Validate the new holder’s health and replication first.
The treatment of the former holder after seizure is role- and situation-dependent. Follow the supported recovery procedure before reconnecting or rebuilding it; do not replace that procedure with a blanket rule that every former holder must never return.
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
[pscustomobject]@{
Forest = 'Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster'
Domain = 'Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster'
Move = 'Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole PDCEmulator'
Seize = 'add -Force only when the holder is gone permanently'
} | Format-List- Stage 1[pscustomobject]@{
Positional values or no named parameters - Stage 2Format-List
Positional values or no named parameters
An example to inspect
Preview the example. Sign in for the full lesson and activities.
[pscustomobject]@{
Forest = 'Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster'
Domain = 'Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster'
Move = 'Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole PDCEmulator'
Seize = 'add -Force only when the holder is gone permanently'
} | Format-ListWhat happens
The example prints role queries and operation strings. It does not transfer or seize a role. Use read-only role queries first and document the intended holder before planning a change.
Worth remembering
After a role move, verify ownership, replication and the operation that required the role.
Primary documentation
Try it
Expected output · prints command text; does not execute these commands
Example reader
Inspect this page's example
Run supported commands against the practice data, or inspect the example without executing it.
Ready to inspect.
Prints the queries for all five FSMO roles and how to move one.
Show reference output
Expected output · prints command text; does not execute these commands
Forest : Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster Domain : Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster Move : Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole PDCEmulator Seize : add -Force only when the holder is gone permanently
Keep going
Next: PowerShell Sites and ServicesCheck your understanding
A role holder is temporarily offline. Should you immediately seize its role?
No. Establish whether the role is needed now and whether the holder can return. Transfer when available; seizure is a recovery decision with role-specific follow-up.