Seizing FSMO Roles in Active Directory: Using PowerShell and NTDSUtil

Introduction

In Active Directory (AD), Flexible Single Master Operations (FSMO) roles are crucial for domain operations. If a domain controller (DC) holding these roles fails permanently, you must seize the roles to another DC to maintain functionality.

This guide covers:
✅ What FSMO roles are
✅ When to seize vs. transfer roles
✅ Seizing FSMO roles using PowerShell
✅ Seizing FSMO roles using NTDSUtil (legacy method)
✅ Best practices to avoid issues

Understanding FSMO Roles

There are five FSMO roles, split into forest-wide and domain-wide roles:

Forest-Wide Roles

1. Schema Master – Manages AD schema changes.
2. Domain Naming Master – Controls domain additions/removals.

Domain-Wide Roles

3. PDC Emulator – Handles password changes, time sync, and Group Policy.
4. RID Master – Allocates Relative IDs (RIDs) for new AD objects.
5. Infrastructure Master – Manages cross-domain object references.

When Should You Seize FSMO Roles?

Seizing is necessary when:
🔴 The original DC has failed permanently and cannot be restored.
🔴 A graceful role transfer is impossible.
🔴 The DC is unrecoverable (hardware failure, corruption).

⚠️ Warning: Seizing is a last resort—always transfer roles first if possible!

Method 1: Seizing FSMO Roles Using PowerShell

Step 1: Verify the Original DC is Unavailable

Check if the old DC is unreachable:

Test-Connection -ComputerName "OldDC" -Count 2  

Step 2: Seize All FSMO Roles

Run this in PowerShell (Admin):

Move-ADDirectoryServerOperationMasterRole -Identity "NewDC" -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster -Force  

(Replace "NewDC" with your target DC.)

Step 3: Verify the Seizure

Check FSMO role holders with:

netdom query fsmo

Or:

Get-ADDomain | FL PDCEmulator, RIDMaster, InfrastructureMaster  
Get-ADForest | FL SchemaMaster, DomainNamingMaster 

Method 2: Seizing FSMO Roles Using NTDSUtil (Legacy Method)

If PowerShell isn’t available, use NTDSUtil (command-line tool).

Step 1: Open CMD as Administrator

Run:

ntdsutil

Step 2: Connect to the Target DC

roles  
connections  
connect to server NewDC  
quit  

Step 3: Seize the FSMO Roles

To seize all roles, run:

seize schema master  
seize domain naming master  
seize PDC  
seize RID master  
seize infrastructure master  

Step 4: Verify & Exit

quit  
quit

Then confirm with:

netdom query fsmo

Best Practices for FSMO Role Seizure

✔ Back up AD before making changes.
✔ Avoid unnecessary seizures—transfer roles first if possible.
✔ Remove the failed DC from AD (if unrecoverable).
✔ Monitor replication after seizing roles.
✔ Document changes for future troubleshooting.

Conclusion

Seizing FSMO roles is critical when a DC fails permanently. Whether using PowerShell or NTDSUtil, following these steps ensures minimal downtime.

🔗 For more IT guides, visit CupsDeeps.com!