CN1276 Server
Kemtis Kunanuraksapong
MSIS with Distinction
MCTS, MCDST, MCP, A+
Agenda
• Chapter 4: Global Catalog and Flexible Single
Master Operations (FSMO) Roles
• Quiz
• Exercise
Global Catalog (GC)
• Four main functions:
▫ Facilitating searches for objects in the forest
▫ Resolving User Principal Names (UPNs)
▫ Maintaining universal group membership
information
▫ Maintaining a copy of all objects in the domain
Global Catalog (Cont.)
• Universal group membership caching
▫ Store universal group memberships on a local DC
• In Win 2k3 and 2k8, A user must have
successfully logged on when a GC server was
available and universal group membership
caching was enabled
• Enabled on a per-site basis.
• By default, cache is refreshed every eight hours.
Additional GC servers
• Each site should contain a GC server to facilitate
user logons
• When placing a GC at a remote site, you should
consider the amount of bandwidth needed
Flexible Single Master Operations
(FSMO) Roles
• Provides a critical task such as schema update to
be assigned by a single DC in each domain or in
a forest
• Five roles:
▫ Domain specific (one per domain)
 Relative Identifier Master
 Infrastructure Master
 Primary Domain Controller (PDC) Emulator
▫ Forest-wide authoriy
 Domain Naming Master
 Schema Master
Relative Identifier (RID) Master
• Responsible for assigning relative identifiers to
domain controllers in the domain
• Relative identifiers are assigned by a domain
controller when a new object is created
• If RID Master is unavailable
▫ unable to create new objects
▫ Unable to move objects between domains
Infrastructure Master
• Responsible for reference updates from its
domain objects to other domains
▫ Assists in tracking which domains own which
objects
Primary Domain Controller (PDC)
Emulator
• Provides backward compatibility
• Manages time synchronization for the domain
• Manages password changes and account
lockouts
▫ it provides immediate replication to other domain
controllers in the domain.
• Managing edits to Group Policy Objects (GPOs)
Domain Naming Master
• Has the authority to manage the creation and
deletion of domains, domain trees, and
application data partitions in the forest.
▫ When any of these is created, the Domain Naming
Master ensures that the name assigned is unique
to the forest.
Schema Master
• Responsible for managing changes to the Active
Directory schema.
Placing FSMO Role Holders
• When you install the first domain controller in a
new forest, that domain controller holds all five
of FSMO Roles
▫ Number of domains that are or will be part of the
forest
▫ The physical structure of the network
▫ The number of DCs in each domain
Managing FSMO Roles
• Role transfer
▫ Used to move a FSMO role gracefully from one
domain controller to another
• Role seizure
▫ Used only when you have experienced a failure of
a domain controller that holds a FSMO role and
you forced an ungraceful transfer
▫ After the seize, the original holder must be
removed from AD before being returned to the
network
• See Table 4-3 on Page 91
Viewing or transferring Domain-Wide
FSMO Role Holders
• Open the AD Users
and Computers
• Right-click the AD
Users and
Computers node > All Tasks ->
Operations Masters
Viewing or Transferring the Domain
Naming Master FSMO Role Holder
• In AD Domains and Trusts
• Right-click the AD Domains and Trusts ->
Change Operations Master
Viewing or Transferring the Schema
Master FSMO Role Holder
• Open the AD Schema
• Right-click AD Schema -> Change Operations
Master
• You need to register the schmmgmt.dll DLL
file using the following syntax:
regsvr32 schmmgmt.dll
Seizing a FSMO Role
• Use the ntdsutil command to access the fmso
maintenance prompt and use the seize
command.
▫ *See full step on Page 96 or Lab 4
Assignment
• Fill in the blank
▫ 1-10
• Multiple Choice
▫ 1-10
• Online Lab 4