header image

Move all fsmo roles

Posted by: | March 18, 2012 | No Comment |

When AD is first installed all of the FSMO roles are placed on the first domain controller in the forest. If you want to move all of the FSMO roles

$server = "server02"            
            
$dom = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()            
$sid = ($dom.GetDirectoryEntry()).objectSid            
$dc = [ADSI]"LDAP://$server/rootDSE"            
            
$fsmo = "becomeSchemaMaster", "becomeDomainMaster", "becomeRidMaster", "becomeInfraStructureMaster", "becomePDC"            
foreach ($role in $fsmo){             
    if ($role -eq "becomePDC"){ $dc.Put($role, $sid[0])}            
    else {$dc.Put($role, 1) }            
    $dc.SetInfo()            
}

Select the server that you want to move them to. Get the domain SID (needed for moving the PDC emulator role) and a directory entry for the target DC.

Loop through the fsmo roles and trigger the change.

There isn’t an easy way to do this with the provider or the cmdlets.

There is a method on the System.DirectoryServices.ActiveDirectory.DomainController class called TransferRoleOwnership. It doesn’t fully work with Windows 2008 and above and I would recommend against its use

under: PowerShell and Active Directory
«
»