Seizing operational master roles

Demo cleaning up the Active Directory database 08:55

Demo removing Active Directory from a recovered server 14:04

What is an operational master role?
See our operational master role video for more information.

Impact of missing operational master role
Seizing an operational master role from a failed server is a drastic step. Once complete, the domain controller can not be started back up on the network. Before seizing the operational master role, first consider the effect the missing operational master role will have as listed below.

Schema master: If this role is missing then changes will not be able to be made to the Active Directory schema. The schema defines the design of the Active Directory database. If you are not planning on making changes to the structure of the Active Directory database this role could be off line indefinitely.

Domain Naming Master: This is required when adding/removing domains. If you are not adding or removing domains the Domain Naming Operational Master Role could be offline indefinitely.

Relative ID Master: Otherwise known as RID master, it allocates RID’s to Domain Controllers. These are used to create Active Directory objects. Without RID’s Domain Controllers cannot create new objects. RID’s are allocated in pools so a domain controller will not run out quickly unless a lot of Active Directory objects are created at once.

PDC Emulator: A PDC emulator is considered the final authority on password authentication. If the PDC emulator is down, a user may experience problems logging in just after a password change. Short outage should not be problem but it is recommended to try to recover the domain controller holding the PDC emulator quickly if it fails.

Infrastructure master: In a single domain/forest environment, a missing infrastructure master will not cause any problems. In a multiple domain environment, this will only cause problems if none of your domain controllers are global catalog servers. If this is the case, cross domain objects may not be updated correctly when changed.

Seizing a role
Seizing a role is considered a last resort and once completed the domain controller that was holding that operational master role will not be able to be started back up on the network again. A domain controller that can have an operational master role transferred or seized is often referred to as a standby operational master.

In order to seize an operational master role, you need to run the command NTDSUtil from the command prompt. Once inside the tool, run the following commands.

roles

connections

connect to server (Domain controller role will be seized by)

quit

Seize PDC|RID master|schema master|infrastructure master|naming master

Removing Domain Controller Configuration
Once you seize the operational master role, the configure data for that domain controller will still exist in Active Directory. This can be removed by performing the following steps.

Run NTDSUtil from the command prompt

metadata cleanup

connect to server (any domain controller)

quit

select operational target

list domain

select domain (your domain number shown in list domain)

list sites

select site (your site number shown in list sites)

list servers in site

select server (your server number shown in list servers in site)

quit

Remove selected server

Quit NTDSUtil

Run Active Directory Sites and Services from administrative tools

Find the record for your failed domain controller. It should not have domain listed next to its name. Press delete to delete the record.

Reusing a failed server
If you have seized an operational master role from a domain controller and later recover the domain controller, Active Directory will need to be removed from the domain controller before it can be added and reused on the domain. This can be done with the following steps.

Make sure the server is not connected to the network.

From the command line run DCPromo /ForceRemoval

References

Credits