FSMO Role: Schema Master

9.6K

When working with Active Directory domains, admins must know how to work with the Flexible Single Master Operation Master (FSMO) roles and how these are used. One of the critical FSMO roles is the Schema Master. What does the Schema Master FSMO role do and can this role be transferred if needed?

What are Flexible Single Master Operation Master roles?

Flexible Single Master Operation (FSMO) roles are essential in managing and operating an Active Directory Domain Services environment. These specific roles prevent conflicts and ensure the smooth functioning of various tasks within the network. Here’s a closer look at each role:

1. Schema Master Role: The Schema Master controls all updates and modifications to the Active Directory schema. This is where class and attribute definitions for all objects within the Active Directory are stored. There can be only one Schema Master in the entire Active Directory forest.
2. Domain Naming Master Role: Responsible for adding and removing domains within an Active Directory forest. It ensures that each domain name is unique across the forest. As with the Schema Master, there is only one Domain Naming Master in the entire forest.
3. Infrastructure Master Role: The Infrastructure Master is tasked with updating references from objects in its domain to objects in other domains. It ensures that cross-domain object references are correctly handled. Each domain within the forest has its own Infrastructure Master.
4. RID Master Role (Relative ID Master): Within each domain, the RID Master allocates pools of unique identifiers (Relative IDs) to different domain controllers. This ensures that every object within the domain receives a unique ID. Every domain has a unique RID Master.
5. PDC Emulator Role (Primary Domain Controller Emulator): This role is essential for backward compatibility and functions as a Primary Domain Controller (PDC) for pre-Windows 2000 clients. It also handles password changes and time synchronization within the domain. Each domain has its own PDC Emulator.
6. Global Catalog Server (Optional): Although not an FSMO role, the Global Catalog Server stores a full copy of all objects in the directory for its host domain and a partial copy for all other domains in the forest. It facilitates searches and logins across the entire forest.
7. Transfer FSMO Roles and Transfer Schema Master: An important aspect of FSMO roles management is the ability to transfer roles between domain controllers if needed. This can be done for various reasons such as maintenance, hardware upgrades, or ensuring optimal performance.

Schema master in detail

Schema Master is an FSMO role in Active Directory Domain Services (AD DS) responsible for making changes to the Active Directory schema. The schema stores descriptions of all Active Directory classes and attributes. The schema partition exists on all DCs, it is named “schema naming context” and is located in LDAP://cn=schema,cn=configuration,dc=<domain>.

Overview of Schema Master Role in Active Directory Domain

There can be only one domain controller with the Schema Master role in the AD forest (it’s an enterprise-level FSMO role). Only a domain controller that owns this role can make changes to the Active Directory schema (contains a read-write copy of schema partition). After updating the forest schema, the changes are replicated from the schema master server to other domain controllers in the AD forest. This role is necessary to prevent conflicting schema changes from two domain controller servers.

The AD schema is a set of objects and their attributes used to store different data. In the screenshot below you can see the user class in the AD schema that defines all the available attributes of the user account object (like employee ID, phone number, email address, SamAccountName and UserPrincipalName, etc.).

You can fill in all of these attributes for any domain user account. You can view the attributes for any domain user account and their values using the Active Directory snap-in (ADUC console) or the ADSIEdit.msc tool. All the tabs and information you see about the properties of any Active Directory object are AD schema.

Check the user attribute values for a built-in domain administrator account using ADSIEdit

For example, you want to check the user attribute values for a built-in domain administrator account using the ADSIEdit.

Open the adsiedit.msc console and connect to the Default naming context. Find the user object in the AD hierarchy and open its Properties.

You can see the object has all the attributes that are defined in the user class (you can display only attributes that have values by pressing the Filter button).

Microsoft best practices in placement and administration of the AD schema

1. Always make an Active Directory backup before changing the schema;
2. It is recommended to keep the Domain Naming Master and Schema Master roles on the same DC (they are rarely used and should be strictly controlled), which should be a Global Catalog (GC) server simultaneously;
3. If you have lost the server with the Schema Master role, you can seize this role to any other domain controller. But keep in mind that the original Schema Master should not appear on the network after that;
4. Perform manual schema changes only in case of extra need. If it needs to be done in any case, see paragraph 1.

If the DC owner of a Schema Master role is unavailable, changing the AD schema is impossible. Note that Schema upgrades are typically performed only during major AD lifecycle events such as introducing newer Windows Server DCs (including Windows Server 2025) or deploying apps that extend the schema, such as Microsoft Exchange Server. Temporary loss of the DC running FSMO Schema Master is not noticeable for domain users. The temporary loss of the Schema Master role owner usually does not impact normal AD operations. If the server running the Schema Master role is broken, you can simply transfer this role to any other online DC.

Note that you should always perform Exchange schema updates from the current Schema Master. You need to verify replication health before and after running Exchange Setup /PrepareSchema to ensure that schema changes replicate successfully across the forest.

Use the Active Directory Schema snap-in

To manage AD schema and transfer the Schema Master role between domain controllers, use the Active Directory Schema mmc snap-in. However, to enable this console, you must first register the dynamic library Schmmgmt.dll.

1. Open the elevated Command prompt;
2. Run the command:
   

   regsvr32 schmmgmt.dll

To manage an AD schema, you must be a Schema Admins Active Directory group member. By default, the Administrator account in the forest root domain is a member of Schema Admins. Note that many schema extension operations (such as Exchange Setup /PrepareSchema) also require membership in the Enterprise Admins group.

For security reasons, Microsoft does not recommend adding other administrator accounts to the Schema Admins group. If you need to change the AD schema, add your account to this group, log in to DC under your account, perform the desired schema modification operation, and remove your account. The Schema Admins group only needs to modify the AD schema; it doesn’t grant any additional permissions in Active Directory.

You can add or remove the admin account to Schema Admins group using the ADUC console or using PowerShell:

Add-ADGroupMember -Identity "Schema Admins" B.Jackson

Remove-ADGroupMember -Identity "Schema Admins" B.Jackson

Before making any schema modifications, you need to ensure that schema updates are allowed on the Schema Master. In most environments this value is managed automatically and is temporarily enabled by Microsoft tools (such as Exchange Setup or ADPREP) when schema updates are required. You can verify this by checking the Schema Update Allowed registry setting:

HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\Schema Update Allowed

or by using tools that enable schema updates during the schema extension process.

How to Check the Active Directory Schema Version?

Note that the schema is updated when ADPREP /forestprep (or the equivalent promotion process) extends the schema.

The following table lists all versions of Active Directory schemas:

Windows Server Version	AD Schema objectVersion
Windows 2000	13
Windows Server 2003	30
Windows Server 2003 R2	31
Windows Server 2008	44
Windows Server 2008 R2	47
Windows Server 2012	56
Windows Server 2012 R2	69
Windows Server 2016	87
Windows Server 2019	88
Windows Server 2022	88
Windows Server 2025	91

You can find out the current version of the schema in your domain using PowerShell:

Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion

You can also check the current forest and domain functional levels using the following commands:

Get-ADForest | Select ForestMode

Get-ADDomain | Select DomainMode

Note that Schema version and functional levels are independent. A forest may use a newer schema version while still operating at an older forest/domain functional level.

For example, objectVersion 91 corresponds to the AD schema used by Windows Server 2025.

After extending the AD schema, you should check if the schema has been updated successfully. Run the following command:

Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion

This command returns the current schema version. You need to compare the value with the expected version (for example, 91 for Windows Server 2025).

You can also check the Schema Master role holder with the command below to confirm which DC applied the schema update:

(Get-ADForest).SchemaMaster

Check Active Directory Replication Health Before Moving the Schema Master Role

Before transferring the Schema Master role to another DC, you should check if AD replication is healthy across the forest.

You can check the overall health of AD using DCDIAG tool:

dcdiag /v

To check the replication status, run the following command:

repadmin /replsummary

In order to review detailed inbound replication information for a specific DC, use the following:

repadmin /showrepl

You can also use the following command to identify AD replication failures with PowerShell:

Get-ADReplicationFailure -Scope Forest

Note that you need to resolve any replication errors before transferring/seizing FSMO roles.

Before transferring the Schema Master role, you need to check if the target DC is online, healthy, and (if required) a Global Catalog server. You can do this with the command:

Get-ADDomainController -Identity DC2

This ensures that the new FSMO role holder is available and ready to accept the Schema Master role.

Moving Schema Master Role to Another Domain Controller

The Schema Master role is installed by default on the first DC in the first domain in the AD forest. You can move this FSMO role to any domain controller within the forest. But keep in mind that if the Schema Master is not available, it won’t be possible to change the AD schema.

Keep in mind that the target DC should be healthy, fully replicated, regularly backed up, and preferably located in the same datacenter as the Domain Naming Master.

If the DC host running the Schema Master role is broken, you can assign (move) the role to any other online domain controller.

Who currently holds the Schema Master FSMO role?

Information about who currently holds the Schema Master FSMO role in the domain is contained in the attribute of the root object CN = Schema – fSMORoleOwner:

Get-ADObject `
(Get-ADRootDSE).schemaNamingContext `
-Properties fSMORoleOwner |
Select-Object fSMORoleOwner

You can find the current FSMO role holders in the domain using the following command:

netdom query fsmo

To identify the FSMO role owners that are not in the current domain, use the command:

netdom query fsmo /domain:<DomainName>

Schema master DC1.theitbros.com
Domain naming master DC1.theitbros.com
PDC DC07.corp.theitbros.com
RID pool manager DC07.corp.theitbros.com
Infrastructure master DC07.corp.theitbros.com
The command completed successfully.

You can quickly identify the current Schema Master role owner using PowerShell:

(Get-ADForest).SchemaMaster

In order to display both forest-wide FSMO roles:

Get-ADForest | Select-Object SchemaMaster,DomainNamingMaster

Run AD Schema console

Tо transfer Schema Master FSMO role you need to run the AD Schema console:

1. Open mmc.exe;
2. Click File > Add/Remove snap-in;
3. Select Active Directory Schema item and press Add > OK;
   

   

4. Right-click on the root of the console, select Change Active Directory Domain Controller, and select the DC on which you want to transfer the role;
5. Next, select Operation Masters and press the Change button.
   

   

Use PowerShell cmdlet to transfer FSMO roles

Also, you can use the PowerShell cmdlet Move-ADDirectoryServerOperationMasterRole to transfer FSMO roles in the AD forest. To use this cmdlet you need to install and import Active Directory module.

For example, to transfer the Schema Master role to a domain controller DC02, run the command:

Move-ADDirectoryServerOperationMasterRole -Identity "dc2" SchemaMaster

Or:

Move-ADDirectoryServerOperationMasterRole -Identity "dc2" -OperationMasterRole SchemaMaster

You should use a role transfer when the current Schema Master is online and operational. We recommend you to seize the role only if the original role owner has permanently failed and cannot be brought back online.

After seizing the Schema Master role, do not reconnect the original role owner to the network unless it has been rebuilt or its AD metadata has been cleaned up.

To force the seizure of the FSMO role, use the -Force parameter. The FSMO role is forcibly seized if the role owner’s domain controller fails to boot, is broken, or cannot be recovered.

Transfer Schema master role using ntdsutil

Also, you can transfer the Schema master role using the ntdsutil command.

1. Run the elevated cmd on the DC and type the ntdsutil command;
2. Type: roles;
3. On the FSMO Maintenance prompt type: connections;
4. Specify the DC name on which you want to transfer the FSMO role: connect to server DC2;
5. On the server connection prompt type: q;
6. To move the Schema master on the current DC: Transfer Schema Master;
7. Press Yes in the prompt dialog.
   

   

Now you can check the current Schema Master role owner.

To check if the new DC owns the Schema Master FSMO role, run the command:

(Get-ADForest).SchemaMaster

After transferring the Schema Master role, you need to check if the updated FSMO ownership has replicated successfully throughout the forest. Run the following command:

repadmin /replsummary

or

repadmin /syncall /AdeP

This ensures that all DCs are aware of the new Schema Master role holder and that replication is healthy.

You can also verify all FSMO role owners with the following command:

netdom query fsmo

Wrapping up

Understanding the importance of the Schema Master FSMO role and knowing how to use and transfer this and other roles in Active Directory is vital for a systems administrator. Understanding how to troubleshoot and even seize roles like the Schema Master when needed is also a crucial part of managing Active Directory Domain Services, allowing admins to keep AD DS working efficiently and problem free.