How to Seize FSMO Roles From Dead Domain Controller

9.3K

This guide explains how to seize an FSMO role from a failed domain controller in Active Directory.

Quick note on FSMO roles

The Flexible Single Master Operations (FSMO) roles are critical components of an Active Directory environment. If a domain controller (DC) that is holding one or more of the five FSMO roles becomes permanently unavailable, the administrator should seize the FSMO role from the original failed DC to another healthy DC.

A simple AD lab with two domain controllers is used in this demonstration:

• DC1 — is a failed domain controller that’s the current owner of all FSMO roles.
• DC2 — the additional domain controller to which we’ll forcefully reassign the FSMO roles.

The administrator account that is used to seize the FSMO role must be a member of the following Active Directory security groups:

FSMO Role	Administrator must be a member of
Schema Master	Schema Admins
Domain Naming Master	Enterprise Admins
RID Master	Domain Admins
PDC Emulator
Infrastructure Master

If necessary, add your Admin account to these groups.

FSMO Roles: Transferring vs. Seizing

The two ways to reassign FSMO roles are transfer and seize. Both methods ultimately move the FSMO roles to another DC.

• Role transferring — is used for the planned demotion of a domain controller (for example, when you decommission a server) or when a DC is temporarily disconnected while performing maintenance tasks. Used when both source and destination DCs are online and healthy.
• Role seizing — should only be used in the event of a complete server failure where recovery is impossible. The source DC is not available in this case.

Microsoft recommendation to seize FSMO role

Microsoft recommends to seize FSMO role in the following situations:

• The DC server has crashed due to an unrecoverable physical hardware or software/OS problem (and you do not have an up-to-date backup of this DC to perform a non-authoritative ADDS restore ).
• The previous Operation Master role holder has been removed using the forceremoval option of Uninstall-ADDSDomainController or the deprecated dcpromo command.
• The Windows Server OS on the DC no longer exists or has been reinstalled.

In short, you can gracefully move (transfer) FSMO roles from one working DC to another or forcefully grab (seize) the FSMO roles from a dead DC.

Important note! Seize the role only if the previous role holder will never come back online and reconnect to the domain. Otherwise, it will cause serious problems in Active Directory. Note that once a role has been seized, the original DC must never be returned to the domain without being rebuilt/properly demoted.

Determine FSMO Roles Owners in AD

Use one of the following commands to list the domain controllers in the forest:

## Using PowerShell
Get-ADDomainController -Filter * | Select-Object `
HostName, Site, OperatingSystem

## Using DSQUERY
dsquery server -forest

Now find the current FSMO role owners in domain:

netdom query fsmo

There are two domain controllers in this forest. And we know that DC1, which holds all five FSMO roles, is dead. This makes DC2 our candidate for the new FSMO role.

Note. If you try to run the FSMO role check using dcdiag /test:FSMOcheck command, you will get an error:

The server holding the PDC role is down.

How to Seize FSMO Roles From a Failed Domain Controller

You can seize FSMO roles in three ways — PowerShell, NTDSUTIL, and Active Directory Users and Computers (ADUC) console.

Seize FSMO Roles with PowerShell

The Move-ADDirectoryServerOperationMasterRole PowerShell cmdlet is the easiest way to seize FSMO roles from a dead DC (this is a built-in Active Directory module cmdlet).

Log on to the domain controller (DC2) and open an elevated PowerShell console. To seize one FSMO role, specify the target DC name and the role name (or its number). For example:

Move-ADDirectoryServerOperationMasterRole -Identity DC2 -OperationMasterRole SchemaMaster -Force

Or

Move-ADDirectoryServerOperationMasterRole -Identity DC2 -OperationMasterRole 3 -Force

Or you can seize all the roles at once:

Move-ADDirectoryServerOperationMasterRole `
-Identity DC2 `
-OperationMasterRole `
PDCEmulator,
RIDMaster,
InfrastructureMaster,
SchemaMaster,
DomainNamingMaster `
-Force

If there are no errors or output on the screen, the FSMO role move operation has been completed successfully. To confirm, let’s check the new FSMO roles owner.

Get-ADDomain | Format-List PDCEmulator, InfrastructureMaster, RIDMaster

Get-ADForest | Format-List DomainNamingMaster, SchemaMaster

Here is an alternative verification method. The netdom query fsmo command provides a quick consolidated view of all FSMO role owners and is commonly used to verify successful role seizure operations:

netdom query fsmo

Seize FSMO Roles using ADUC

It is possible to seize the FSMO roles using the graphical Active Directory snap-ins. It is a fairly simple and intuitive way, but it takes longer compared to PowerShell.

Note that this method performs metadata cleanup and role seizure simultaneously. It is less granular than PowerShell because you can’t seize individual roles.

Log on to the domain controller that will be the new FSMO roles owner (DC2) and open the ADUC console (dsa.msc).

Click the Domain Controllers Organizational Unit (OU) and look for the failed domain controller (DC1). Right-click the failed DC and click Delete.

When asked to confirm the deletion, click Yes.

You’ll receive a warning that you’re deleting a domain controller without running the removal wizard. But since we’re removing a dead domain controller, check the box to Delete this Domain Controller anyway and click Delete.

Click Yes to confirm the deletion of this domain controller.

The deletion will detect that DC1 is the owner of the FSMO roles. If the deleted DC owned FSMO roles, Active Directory will prompt you to seize and reassign those roles during the cleanup process.

Once DC1 is deleted, right-click the domain and click Operations Masters.

Now, click through each tab (RID, PDC, and Infrastructure) and confirm that the operations master is DC2.

Next, open the Active Directory Domains and Trusts console. Click Action → Operations Master.

Confirm that DC2 is now the Domain Naming operations master.

Now, let’s check the Schema Master role. Run the below command in an elevated PowerShell window to register the Active Directory Schema Management console:

regsvr32 schmmgmt.dll

Next, open MMC and add the Active Directory Schema snap-in.

Right-click the Active Directory Schema node → Operations Master. Confirm the DC2 is the current schema master.

Using the GUI, you’ve successfully seized the FSMO role from a failed domain controller.

Alternative Legacy Method Using NTDSUTIL

NTDSUTIL is a legacy AD management tool that is still supported in modern Windows Server versions. However, Microsoft and enterprise admins now commonly prefer PowerShell cmdlets for FSMO seizure and metadata cleanup tasks (they are easier to automate, less error-prone, and better suited for modern admin workflows). You should use NTDSUTIL primarily for compatibility/advanced troubleshooting.

Open PowerShell or command prompt as admin and run the ntdsutil command.

Next, enter each command below.

roles
connections
connect to server DC2
q

Run the below command to seize the Schema master FSMO role:

seize schema master

You will be prompted to confirm the role seizure. You will be prompted to confirm the seizure operation. Click Yes.

Repeat the seizure process for the remaining FSMO roles as needed:

seize naming master
seize infrastructure master
seize rid master
seize pdc

Keep in mind that the NTDSUTIL tool remains useful for compatibility and advanced recovery cases, but you should prefer PowerShell for most FSMO role seizure tasks.

Post-Seizure Validation Tasks

After you’ve successfully seized the FSMO roles, here are some post-cleanup tasks you must do.

1. Delete the failed DC from the Active Directory Sites and Services snap-in (dssite.msc).
   Then remove failed DC metadata with Powershell:
   Remove-ADDomainController -Identity DC1 -ForceRemoval
   

   

2. Make sure you delete the DNS records pointing to the removed DC. These DNS records can be removed automatically by DNS Scavenging, or you can remove them manually using the DNS Manager console.

   

3. After seizing the FSMO roles, review the Directory Services and DNS logs in Event Viewer and check AD replication health using the following commands:
   
   dcdiag /v
   repadmin /replsummary
   repadmin /showrepl
   Resolve-DnsName yourdomain.local
   
   # PowerShell validation
   Get-ADReplicationFailure -Scope Domain
   
   In case the PDC Emulator role was seized, you need to verify that the new FSMO role holder is correctly functioning as the domain time source:
   
   w32tm /query /status
   w32tm /query /configuration
   w32tm /monitor
   
   Don’t forget to verify that the new PDC Emulator is syncing time correctly and advertising itself as a reliable time source for the domain.

If the RID Master role was seized, you should check if the new role holder can allocate RID pools correctly and that no RID-related errors are reported:

dcdiag /test:ridmanager /v

Note that seizing an FSMO role from a failed DC is a critical task that must be performed carefully. It should be used as a last resort if a domain controller holding an FSMO role fails and cannot be restored.

Verify Global Catalog availability

If the failed DC was hosting the Global Catalog role, you need to make sure that another DC is configured as a Global Catalog server.

You can check GC status with the following command:

Get-ADDomainController -Filter * |
Select-Object HostName, IsGlobalCatalog

If no Global Catalog server is available, you should enable the Global Catalog option on an appropriate DC using Active Directory Sites and Services. Make sure at least one healthy DC remains available as a Global Catalog server.