schema master console rootl

FSMO Role: Schema Master


Schema Master is another FSMO domain controller role which is responsible for making changes to the Active Directory schema. The schema stores descriptions of all Active Directory classes and attributes. The schema partition is exists on all DCs, its named “schema naming context” and located in LDAP://cn=schema,cn=configuration,dc=<domain>.

Domain administrators quite a rarely need to make changes to the AD schema: for example, when you need to extend the schema using adprep/forestprep, upgrade the domain functional level or install Exchange Server, Skype for Business Server or other enterprise application that store object configuration and properties in AD.

Overview of Schema Master Role in the Active Directory Domain

In the entire AD there can be only one domain controller with the Schema Master role (is an enterprise-level FSMO role). Only this domain controller can make changes to the Active Directory schema (contains a writable schema partition). After updating the forest schema, the changes are replicated from the schema master server to other domain controllers in the AD forest. This role is necessary to prevent conflicting schema changes from two domain controller servers.

The AD schema is a set of objects and their attributes, that are used to store different data. On the screenshot below you can see the user class in the AD schema, which defines all the available attributes of the user account object (like employee ID, phone number, email address SamAccountName and UserPrincipalName, etc.).

schema master

You can fill all of these attributes for any domain user account. You can check which attributes are filled in for any domain user account and their values using the ADUC console or using ADSIEdit.msc tool.

For example, you want to check the user attribute values for built-in domain administrator account using the ADSIEdit.

Open the adsiedit.msc console and connect to the Default naming context. In the AD hierarchy, find the user object and open its Properties.

change schema master

You can see that the object has all the attributes that are defined in the user class (you can display only attributes that have values by pressing the Filter button).

schema master role

Microsoft recommends the following best practices in the placement and administration of the Active Directory schema:

  1. Always make an AD backup before changing the schema. Before the process of schema changes, you can shut down all the domain controllers except the FSMO Schema Master role owner. After that, make a system state backup of the domain controller, perform all the necessary changes and, and in case everything is well, simply turn on all DCs. If something went wrong, just restore the running controller from a previous backup, turn on the rest DCs and then explore the problem.
  2. It is recommended to keep the Domain Naming Master and Schema Master roles on the same DC (they are rarely used and should be strictly controlled), that should simultaneously be a Global Catalog (GC) server.
  3. If you have lost the server with Schema Master role, you can seize this role to any other domain controller. But keep in mind that the original Schema Master should not appear on the network after that.
  4. Perform manual schema changes only in case of extra need. If this still needs to be done in any case, see paragraph 1.

If the DC owner of a Schema Master role is unavailable, it is not possible to change the AD schema. However, the upgrade of the schema is usually not performed often (as a rule when installing new DCs with a newer Windows Server version or installing some other server products, such as Exchange). In practice, the Schema Master role owner can remain offline for years without noticeable effect.

To manage AD schema and transfer the Schema Master role between domain controllers, use the Active Directory Schema mmc snap-in. However, to enable this console you must register the dynamic library Schmmgmt.dll at first.

  1. Open the elevated Command prompt;
  2. Run the command:
    regsvr32 schmmgmt.dll

    transfer schema master

Tip. To manage an AD schema you must be a member of the Schema Admin security group.

Moving Schema Master Role to Another Domain Controller

You can find the current FSMO role holders in the domain using the following command:

netdom query fsmo

To identify the FSMO role owners not in the current domain use the command:

netdom query fsmo /domain:<DomainName>

Schema master DC1.theitbros.com

Domain naming master DC1.theitbros.com

PDC DC07.corp.theitbros.com

RID pool manager DC07.corp.theitbros.com

Infrastructure master DC07.corp.theitbros.com

The command completed successfully.

transfer schema master role

You can also quickly find the Schema master owner using the following PowerShell command:

Get-ADForest theitbros.com| ft SchemaMaster

schema master fsmo role

То transfer Schema Master FSMO role you need to run the AD Schema console.

  1. Open mmc.exe;
  2. Click File > Add/Remove snap-in;
  3. Select Active Directory Schema item and press Add > Ok;
    active directory schema master
  4. Right click on the root of the console, select Change Active Directory Domain controller and select the DC on which you want to transfer the role;
  5. Next select Operation Masters and press Change button;
    schema master role transfer

Tip. You can’t change Schema Master role owner from source server.

Also you can use the PowerShell cmdlet Move-ADDirectoryServerOperationMasterRole to transfer any of the FSMO role in AD forest. To use this cmdlet you need to install and import the Active Directory for Windows PowerShell module (check this article).

For example, to transfer Schema Master role to a domain controller DC02, run the command:

Move-ADDirectoryServerOperationMasterRole -Identity "dc2" SchemaMaster

Or

Move-ADDirectoryServerOperationMasterRole -Identity "dc2" –OperationMasterRole 3

To forced seizing of the FSMO role owner with the PowerShell, use the option –Force.

Also, you can transfer Shema master role with the ntdsutil tool.

  1. Run the elevated cmd on the DC and type the ntdsutil command;
  2. Type: roles;
  3. On the FSMO Maintenance prompt type: connections;
  4. Specify the DC name on which you want to transfer FSMO role: connect to server DC2;
  5. On the server connection prompt type: q;
  6. To move the Schema master on the current DC: Transfer Schema Master;
  7. Press Yes in the prompt dialog.

what is schema master role

Now you can check the current Schema Master role owner.

You may also like:

AD Account Keeps Locking Out Sometimes there are situations when AD account keeps locking out, this happen when you try to log on to a domain computer and getting an error on the ...
Installing Active Directory Users and Computers MM... One of the main Active Directory domain management tools is the MMC snap-in Active Directory Users and Computers (ADUC). The ADUC snap-in is used to p...
How to transfer FSMO Roles From a Failed Domain Co... In case domain controller, which owns FSMO (Flexible Single Master Operation) roles, is fail (virus attack, fatal software problems or catastrophic ha...
Store BitLocker Recovery Keys using Active Directo... In a domain network, you can store the BitLocker recovery keys for encrypted drives in the Active Directory Domain Services (AD DS). This is one of th...
Change Default OU permissions in Active Directory By default, each newly created organizational unit (OU) in the access list includes read permission for the group Authenticated Users (built-in group)...

Add Your Comment