Global Catalog and Flexible Single Master Operations (FSMO) Roles

1. Global Catalog and Flexible Single Master Operations (FSMO) Roles BAI516

2. Global Catalog • Critical component of Active Directory. • Acts as a central repository by holding: • A complete copy of all objects from the host server’s local domain. • A partial copy of all objects from other domains within the same forest • Used for logon, object searches, and universal group memberships.

3. Global Catalog • Global catalog placement considerations include: • The speed and reliability of the WAN link. • The amount of traffic that will be generated by replication. • The size of the global catalog database. • Global catalogs are identified with DNS through the SRV records (global catalog, or _gc, service).

4. Global Catalog • By default, the first domain controller installed in the forest root domain is designated as a global catalog server. • Any or all domain controllers in a domain can be designated as global catalog server.

5. Configuring an Additional Global Catalog Server • Use Active Directory Sites and Services from the Administrative Tools folder.

6. Enabling Universal Group Membership Caching • Use Active Directory Sites and Services.

7. Flexible Single Master Operations (FSMO) Roles • To keep a tight control on certain sensitive or special operations, Active Directory uses Flexible Single Master Operations (FSMO) roles. • Relative Identifier Master. • Infrastructure Master. • Primary Domain Controller (PDC) Emulator. • Domain Naming Master. • Schema Master.

8. Relative Identifier (RID) Master • Domain specific (one per domain). • Responsible for assigning relative identifiers to domain controllers in the domain. • Relative identifiers are variable-length numbers assigned by a domain controller when a new object is created.

9. Infrastructure Master • Domain specific (one per domain). • Responsible for reference updates from its domain objects to other domains. • Assists in tracking which domains own which objects.

10. Primary Domain Controller (PDC) Emulator • Domain specific (one per domain). • Provides backward compatibility with Microsoft Windows NT 4.0 domains and other down-level clients. • Manages account lockouts. • Manages time synchronization for the domain. • Manages password changes. • When a password is changed, it provides immediate replication to other domain controllers in the domain. • Managing edits to Group Policy Objects (GPOs)

11. Domain Naming Master • Forest specific (one per forest). • Has the authority to manage the creation and deletion of domains, domain trees, and application data partitions in the forest. • When any of these is created, the Domain Naming Master ensures that the name assigned is unique to the forest.

12. Schema Master • Forest specific (one per forest). • Responsible for managing changes to the Active Directory schema.

13. Flexible Single Master Operations (FSMO) Roles • When you install the first domain controller in a new forest, that domain controller holds both of the forest-wide FSMOs as well as the three domain-wide FSMOs for the forest root domain.

14. Managing FSMO Roles • Role transfer - Used to move a FSMO role gracefully from one domain controller to another. • Role seizure - Used only when you have experienced a failure of a domain controller that holds a FSMO role and you forced an ungraceful transfer.

15. Viewing or transferring Domain-Wide FSMO Role Holders • Open the Active Directory Users and Computers MMC snap-in. • Right-click the Active Directory Users and Computers node, click All Tasks, and select Operations Masters.

16. Viewing or Transferring the Domain Naming Master FSMO Role Holder • In Active Directory Domains and Trusts, right-click the Active Directory Domains and Trusts node and select Change Operations Master.

17. Viewing or Transferring the Schema Master FSMO Role Holder • Open the Active Directory Schema snap-in. • Right-click Active Directory Schema from the console tree and select Change Operations Master. • Remember that before you can access the Active Directory Schema snap-in, you need to register the schmmgmt.dll DLL file using the following syntax: regsvr32 schmmgmt.dll

18. Seizing a FSMO Role • Use the ntdsutil command to access the fmso maintenance prompt and use the seize command.

19. Summary • The global catalog server acts as a central repository for Active Directory by holding a complete copy of all objects within its local domain and a partial copy of all objects from other domains within the same forest. • The global catalog has three main functions: the facilitation of searches for objects in the forest, resolution of UPN names, and provision of universal group membership information.

20. Summary • A global catalog should be placed in each site when possible. As an alternate solution when a site is across an unreliable WAN link, universal group membership caching can be enabled for the site to facilitate logon requests.

21. Summary • The Schema Master and Domain Naming Master roles are forest-wide. • Every forest must have one and only one of each of these roles. • The RID Master, PDC Emulator, and Infrastructure Master roles are domain-wide. • Every domain must have only one of each of these roles.

22. Summary • The default placement of FSMO roles is sufficient for a single-site environment. • However, as your network expands, these roles should be divided to increase performance and reliability.

23. Summary • FSMO roles can be managed in two ways: • Role transfer - Transfer a FSMO role to other domain controllers in the domain or forest to balance the load among domain controllers or to accommodate domain controller maintenance and hardware upgrades. • Role seizure - Seize a FSMO role assignment when a server holding the role fails and you do not intend to restore it. • Seizing a FSMO role is a drastic step that should be considered only if the current FSMO role holder will never be available again.

24. Summary • Use repadmin to check the status of the update sequence numbers (USNs) when seizing the FSMO role from the current role holder. • Use ntdsutil to actually perform a seizure of the FSMO role.

25. Questions?

26. Hands – On • Lab 7