Seizing FSMO roles 1

[jcrapps]

Hi All,
I am trying to seize the "Domain Naming Master" role from a domain controller that doesn't exist anymore. There's no way to transfer the role because I can't contact it w/ NTDSUTIL. I can't even force a seizure of that FSMO. How can I take control of this role?

Best regards

 

[WhoKilledKenny]

Make sure the Account you are using to seize the "Domain Naming Master" is a member of the Enterprise Admins Group, otherwise the seize will fail.

Here is a list of which group membership is required for FSMO role seizure:
Schema - Schema Admins
Domain Naming - Enterprise Admins
RID - Domain Admins
PDC - Domain Admins
Infrustructure - Domain Admins

Ater you seize the rolls you may have to clean up old AD controller:

http://www.petri.co.il/fix_unsuccessful_demotion.htm

 

[WhoKilledKenny]

Also,
make sure you are running ntdsutil on a domain controller in your environment.

 

[jcrapps]

Thanks much for the help. I didn't check if the administrator was part of Enterprise Admins. I'll check that soon. Thanks very much for your helpful post!

 

[jcrapps]

Well, I found that there wasn't a problem at all. I got some error saying that the role transfer failed, but it actually didn't. I ran "netdom query fmso" and all the roles had transferred.

 

[markdmac]

Verify you get the same results on all DCs when you do a netdom query fsmo.

If the old server was not grqacefully removed from AD you will get replication errors in AD. Referr to the script at the bottom of my FAQ for an easy way to clean up your AD Metabase.

faq96-4733

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.