Move all fsmo roles

When AD is first installed all of the FSMO roles are placed on the first domain controller in the forest. If you want to move all of the FSMO roles

$server = "server02"            
$dom = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()            
$sid = ($dom.GetDirectoryEntry()).objectSid            
$dc = [ADSI]"LDAP://$server/rootDSE"            
$fsmo = "becomeSchemaMaster", "becomeDomainMaster", "becomeRidMaster", "becomeInfraStructureMaster", "becomePDC"            
foreach ($role in $fsmo){             
    if ($role -eq "becomePDC"){ $dc.Put($role, $sid[0])}            
    else {$dc.Put($role, 1) }            

Select the server that you want to move them to. Get the domain SID (needed for moving the PDC emulator role) and a directory entry for the target DC.

Loop through the fsmo roles and trigger the change.

There isn’t an easy way to do this with the provider or the cmdlets.

There is a method on the System.DirectoryServices.ActiveDirectory.DomainController class called TransferRoleOwnership. It doesn’t fully work with Windows 2008 and above and I would recommend against its use

This entry was posted in PowerShell and Active Directory. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s