.png?width=100&auto=webp&quality=80&disable=upscale "Picture of John Savill")
.png?width=400&auto=webp&quality=80&disable=upscale "John Savill")
Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
What are the FSMO roles in Windows 2000?
John Savill
January 8, 2000
3 Min Read
A. In Windows 2000, all domain controllers (DCs) are equal. Changes replicate to all the DCs in a domain through a process known as multimaster replication. Multimaster replication resolves conflicts.
In some situations, preventing conflicts is preferable. Five Flexible Single-Master Operation (FSMO) roles, formerly known as Floating Single-Master Operation roles, manage an aspect of the domain or forest, to prevent conflicts. You can manually move these roles between DCs.
Two types of roles exist: domain and forest. Only a DC in the domain can hold a domain-specific FSMO role, whereas any DC in the forest can hold a forest FSMO role. DCs can’t hold FSMO roles in other domains or forests.
You can use the Ntdsutil utility or one of several GUI methods to assign FSMO roles. The following table summarizes each role.
Role Name | Description | Per Domain or Forest |
Domain Naming Master | If you want to add a domain to a forest, the domain’s name must be verifiably unique. The forest’s Domain Naming Master FSMOs authorize the domain name operation. | One per forest |
Infrastructure Master | When a user and group are in different domains, a lag can exist between changes to the user (e.g., a name change) and the user’s display in the group. The Infrastructure Master of the group’s domain fixes the group-to-user reference to reflect the change. The Infrastructure Master performs its fixes locally and relies on replication to bring all other replicas of the domain up to date. | One per domain |
PDC Emulator | For backward compatibility, one DC in each Win2K domain must emulate a PDC for the benefit of Windows NT 4.0 and NT 3.5 DCs and clients. | One per domain |
RID Master | Any DC can create new objects (e.g., users, groups, computer accounts). However, after creating 512 user objects, a DC must contact the domain’s Relative Identifier (RID) Master for another 512 RIDs. (A DC actually contacts the RID Master when the DC has fewer than 100 RIDs left. Thus, the RID Master can be unavailable for short periods of time without causing object creation problems.) This procedure ensures that each object has a unique RID.When a DC creates a security principal object, the DC attaches a unique SID to the object. The SID consists of the domain SID and a RID. The RID Master must be available for you to use the Microsoft Windows 2000 Resource Kit’s Movetree utility to move objects between domains. | One per domain |
Schema Master | At the heart of Active Directory (AD) is the schema, which is like a blueprint of all objects and containers. Because the schema must be the same throughout the forest, only one machine can authorize schema modifications. | One per forest |
Even in native mode, the PDC Emulator has the following special roles.
Failed authentication requests
For downlevel clients who issue a change (e.g., a password change) that would normally go to the PDC in an NT4.0 domain
Focus of best-effort push of password changes an account lockouts
In cases in which a time server client contacts the DC, the DC contacts the PDC Emulator, and the PDC Emulator contacts the PDC one level up, the PDC Emulator root domain could use Simple Network Time Protocol (SNTP) to contact an atomic Internet clock
Focus of group policies: If you edit or create a group policy, you contact the PDC; if the PDC isn't available, you can select another DC
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
