Flexible Single Master Operations (FSMO)

以你之姓@ 2021-10-24 03:28 70阅读 0赞

Certain domain and enterprise-wide operations that are not good for multi-master updates are performed by a single domain controller in an Active Directory domain or forest. The domain controllers that are assigned to perform these unique operations are called operations masters or FSMO role holders.  
虽然AD中的DC支持Multi-master，但是有些角色需要由单独的DC承担，这些角色有5种类型，其中两种针对Forest，其余针对Domain。  
  
The following list describes the 5 unique FSMO roles in an Active Directory forest and the dependent operations that they perform:

<table> 
 <tbody> 
  <tr> 
   <td>•</td> 
   <td><strong>Schema master</strong> - The Schema master role is <span style="color:#FF0000;"><strong>forest-wide and there is one for each forest</strong></span>. This role is required to extend the schema of an Active Directory forest or to run the <b>adprep /forestprep</b> command.</td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td><strong>Domain naming master</strong> - The Domain naming master role is <span style="color:#FF0000;"><strong>forest-wide and there is one for each forest</strong></span>. This role is required to add or remove domains or application partitions to or from a forest.</td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td><strong>RID master</strong> - The RID master role is <span style="color:#0000ff;"><strong>domain-wide and there is one for each domain</strong></span>. This role is required to allocate the RID pool so that new or existing domain controllers can create user accounts, computer accounts or security groups. </td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td><strong>PDC emulator</strong> - The PDC emulator role is <span style="color:#0000ff;"><strong>domain-wide and there is one for each domain</strong></span>. This role is required for the domain controller that sends database updates to Windows NT backup domain controllers. The domain controller that owns this role is also targeted by certain administration tools and updates to user account and computer account passwords. </td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td><strong>Infrastructure master</strong> - The Infrastructure master role is <span style="color:#0000ff;"><strong>domain-wide and there is one for each domain</strong></span>. This role is required for domain controllers to run the <b>adprep /forestprep</b> command successfully and to update SID attributes and distinguished name attributes for objects that are referenced across domains.</td> 
  </tr> 
 </tbody> 
</table>

The Active Directory Installation Wizard (Dcpromo.exe) assigns all 5 FSMO roles to the first domain controller in the forest root domain. The first domain controller in each new child or tree domain is assigned the three domain-wide roles. Domain controllers continue to own FSMO roles until they are reassigned by using one of the following methods:

<table> 
 <tbody> 
  <tr> 
   <td>•</td> 
   <td>An administrator reassigns the role by using a GUI administrative tool. </td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td>An administrator reassigns the role by using the <b>ntdsutil /roles</b> command. </td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td>An administrator gracefully demotes a role-holding domain controller by using the Active Directory Installation Wizard. This wizard reassigns any locally-held roles to an existing domain controller in the forest. Demotions that are performed by using the <b>dcpromo /forceremoval</b> command leave FSMO roles in an invalid state until they are reassigned by an administrator.</td> 
  </tr> 
 </tbody> 
</table>

We recommend that you transfer FSMO roles in the following scenarios:

<table> 
 <tbody> 
  <tr> 
   <td>•</td> 
   <td>The current role holder is operational and can be accessed on the network by the new FSMO owner. </td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td>You are gracefully demoting a domain controller that currently owns FSMO roles that you want to assign to a specific domain controller in your Active Directory forest.</td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td>The domain controller that currently owns FSMO roles is being taken offline for scheduled maintenance and you need specific FSMO roles to be assigned to a “live” domain controller. This may be required to perform operations that connect to the FSMO owner. This would be especially true for the PDC Emulator role but less true for the RID master role, the Domain naming master role and the Schema master roles. </td> 
  </tr> 
 </tbody> 
</table>

We recommend that you seize FSMO roles in the following scenarios:

<table> 
 <tbody> 
  <tr> 
   <td>•</td> 
   <td>The current role holder is experiencing an operational error that prevents an FSMO-dependent operation from completing successfully and that role cannot be transferred. </td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td>A domain controller that owns an FSMO role is force-demoted by using the <b>dcpromo /forceremoval</b> command. </td> 
  </tr> 
  <tr> 
   <td>•</td> 
   <td>The operating system on the computer that originally owned a specific role no longer exists or has been reinstalled.</td> 
  </tr> 
 </tbody> 
</table>

[  
Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller][Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller]  
注意Seize翻译成占用，Transfer翻译为传输

转载于:https://www.cnblogs.com/chinapro/archive/2005/07/23/198717.html

[Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller]: http://support.microsoft.com/default.aspx?scid=kb;en-us;255504