Module 7: FSMO Roles, Trusts & Forest Management

← Module 6: Sites & Replication

Module 7 of 8

Module 8: Security →

🎯 AD Administration Course · Module 7 of 8

FSMO Roles, Trusts & Forest Management

📂 Course: Active Directory Administration
📦 Module: 7 of 8
🎯 Exam: AZ-800
⏱ Read time: ~28 min
AZ-800
AZ-800 Exam Alignment
AZ-800

Manage FSMO roles and AD trust relationships: Identify all five FSMO roles and their functions, transfer and seize roles, configure trust relationships between domains and forests, and manage the AD forest lifecycle.

  • Know all 5 FSMO roles — which are per-forest (Schema Master, Domain Naming Master) vs per-domain (PDC Emulator, RID Master, Infrastructure Master)
  • Understand the difference between transferring and seizing a FSMO role — seizing is only used when the current role holder is permanently failed
  • Know the four trust types: External, Forest, Shortcut, and Realm — and when each is used
  • Know that all trusts are transitive within a forest but not across separate forests (unless forest trust is established)
Exam Tip: AZ-800 tests FSMO roles in failure scenarios. Know that if the PDC Emulator is offline, password changes and account lockouts may not replicate promptly. If the RID Master is offline, domain controllers will eventually run out of RIDs and cannot create new security principals. The Infrastructure Master should NOT be on a global catalog server (unless all DCs are GCs).
FSMO (Flexible Single Master Operations) roles prevent write conflicts in Active Directory by ensuring certain operations are only performed by one DC at a time. Five roles are distributed across domain controllers in a forest, and understanding which role does what — and what breaks when each is unavailable — is fundamental to AD administration and a frequently tested AZ-800 topic.

🎯 The Five FSMO Roles

FSMO Role Scope Function Impact if Offline
Schema Master Forest-wide (1 per forest) The only DC that can make changes to the AD schema (add new object classes or attributes). Used during AD upgrades and application installations (Exchange, Lync). Schema changes fail. No operational impact for day-to-day directory operations.
Domain Naming Master Forest-wide (1 per forest) Controls adding or removing domains from the forest. Must be online to add, rename, or remove a domain or application directory partition. Cannot add or remove domains. No impact on existing operations.
PDC Emulator Per domain (1 per domain) Handles password changes and account lockouts (replicates urgently to PDC Emulator). Authoritative time source for the domain. Processes legacy NT clients. GPO focus/editing anchor. Password changes may be slow to replicate. Account lockout processing delayed. Time drift may occur. Most impactful FSMO role to lose.
RID Master Per domain (1 per domain) Allocates pools of RIDs (Relative Identifiers) to each DC. Every new security principal (user, group, computer) receives a unique SID constructed from the domain SID + a unique RID. DCs will exhaust their RID pools and eventually cannot create new security principals. Takes time to be felt (pools last for weeks).
Infrastructure Master Per domain (1 per domain) Maintains cross-domain references — updates phantom objects when objects in other domains are moved or renamed. Important in multi-domain forests. Cross-domain object references may become stale. Low impact in single-domain forests. Do NOT place on a GC server (unless all DCs are GCs) — GC servers won’t update phantoms correctly.

💡 Infrastructure Master + Global Catalog Warning

  • The Infrastructure Master should NOT be placed on a Global Catalog server — unless ALL domain controllers in the domain are also global catalog servers
  • GC servers already have read-only copies of all objects in the forest, so they won’t recognise phantom objects that need updating — defeating the Infrastructure Master’s purpose
  • In a single-domain forest, this rule doesn’t matter because there are no cross-domain references to update

🔄 Transferring vs Seizing FSMO Roles

Operation When to Use Method Can the Original Role Holder Return?
Transfer Planned migration (DC decommission, maintenance). The original role holder is still online. ADUC / ADAC / AD Domains and Trusts / PowerShell Move-ADDirectoryServerOperationMasterRole Yes — transfer is graceful and both DCs are synchronized before the move.
Seize Emergency only — the original role holder has permanently failed and cannot be recovered. The DC will NOT be brought back online. PowerShell Move-ADDirectoryServerOperationMasterRole -Force or ntdsutil Never — if the original DC comes back online after a seizure, it must be immediately isolated and demoted. Conflicts will occur.

⚠️ Seizing the PDC Emulator vs RID Master

If the PDC Emulator fails temporarily, do not seize — wait for it to come back or perform a graceful transfer if decommissioning. Seizing is only appropriate when the DC is gone permanently. The RID Master seizure is also sensitive — after seizing, the old RID pool is lost, and some RIDs may have been partially allocated. Always document seize operations and immediately rebuild the failed DC as a new server with a new name.

🔗 Active Directory Trust Relationships

Trust Type Direction Transitive? Use Case
External Trust One-way or two-way No Trust between a specific domain in one forest and a specific domain in another forest. Does not extend to other domains in either forest.
Forest Trust One-way or two-way Yes (within the trusted forests) Trust between entire forests. Users in any domain in Forest A can access resources in any domain in Forest B. Requires Windows Server 2003+ forest functional level.
Shortcut Trust One-way or two-way Yes Optimises authentication between two domains that are not directly connected in the trust path within the same forest. Reduces the number of hops for Kerberos referrals.
Realm Trust One-way or two-way Configurable Trust between an AD domain and a non-Windows Kerberos realm (Linux/Unix Kerberos). Used for cross-platform authentication.
AD Domains and Trusts › techcareers.local › Properties › Trusts tab
AD
Active Directory Domains and Trusts
|
techcareers.local Properties
🏝️ AD Domains and Trusts
🌎 techcareers.local
🔗 Trusts
🌎 partner.com

techcareers.local — Trust Relationships
Trusted Domain Trust Type Direction Transitive
partner.com Forest Trust Two-way Yes
legacy.corp External Trust One-way (inbound) No

PowerShell — FSMO Roles & Trust Management

# View current FSMO role holders for the domain
Get-ADDomain | Select-Object PDCEmulator,RIDMaster,InfrastructureMaster

# View forest-level FSMO role holders
Get-ADForest | Select-Object SchemaMaster,DomainNamingMaster

# Transfer FSMO roles gracefully (source role holder must be online)
Move-ADDirectoryServerOperationMasterRole -Identity 'DC02' -OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster

# Seize a FSMO role (only if original holder is PERMANENTLY unavailable)
Move-ADDirectoryServerOperationMasterRole -Identity 'DC02' -OperationMasterRole PDCEmulator -Force

# Quick view of all 5 FSMO role holders
netdom query fsmo

# Create a forest trust with partner.com
netdom trust partner.com /domain:techcareers.local /add /twoway /passwordt:TrustP@ssword

💡 Best Practices

  • Place PDC Emulator on the most powerful, well-connected DC in each domain — it is the most actively used FSMO role and handles time synchronisation for the domain
  • Transfer FSMO roles before decommissioning a DC — use netdom query fsmo to verify all roles are hosted before removing a DC
  • Place the Infrastructure Master on a DC that is NOT a global catalog server (in multi-domain forests) — unless all DCs are GCs
  • Never seize a FSMO role unless the current holder is permanently lost and cannot be recovered — seizing a role from a live DC causes split-brain conflicts
  • Keep a written record of which DC holds each FSMO role — this information is critical during disaster recovery
  • Place Schema Master and Domain Naming Master together on the same DC (forest root DC is conventional) — both are rarely used and this simplifies management

🎓 Interview Q&A

Q: Why is the PDC Emulator the most critical FSMO role?
The PDC Emulator has the broadest impact on daily operations. Its responsibilities include: (1) processing failed password authentication — when a logon fails on any DC, that DC contacts the PDC Emulator to check for recent password changes before rejecting logon; (2) replicating password changes to the PDC Emulator urgently — faster than normal replication, preventing lockouts from stale passwords; (3) serving as the authoritative time source for all DCs in the domain (DCs sync to the PDC Emulator, clients sync to DCs); (4) acting as the GPO editing anchor in the GPMC by default; and (5) handling account lockout processing. When the PDC Emulator is offline, users may experience false lockouts and delayed password change effects.

Q: What is the difference between a forest trust and an external trust?
A forest trust is established between two entire AD forests and is transitive within each forest — meaning all domains in Forest A trust all domains in Forest B through the single forest trust relationship. It requires Windows Server 2003+ forest functional level. An external trust is established between a single specific domain in one forest and a single specific domain in another forest (or a Windows NT 4.0 domain). External trusts are non-transitive — they do not extend to other domains in either forest. External trusts are used for legacy domain compatibility or when you only need cross-domain access for specific domains rather than entire forests.

Q: The DC holding the RID Master role has failed and cannot be recovered. Should you seize the role immediately?
Not necessarily immediately. Each domain controller holds a pool of approximately 500 RIDs allocated in advance from the RID Master. DCs will not run out of RIDs instantly — a DC with 499 unused RIDs can continue creating new security principals for a long time. If the RID Master failure is temporary (hardware issue, pending repair), wait — do not seize. If the DC is permanently lost and will not return, then seize the role using Move-ADDirectoryServerOperationMasterRole -Force. After seizing, the old RID pool values are not known, so there is a theoretical (very low) risk of RID collision — this is a known and accepted risk of seizure.

🎯 AZ-800 Mock Test
Module 7 — FSMO Roles, Trusts & Forest Management
5 questions · Scenario-based · Pass mark: 70%

Question 1 of 5

Users report that after changing their password, they can still log on with the old password for several minutes from different workstations. Which FSMO role is most likely involved in this issue?

ARID Master — responsible for unique identifiers during password changes
BPDC Emulator — password changes are urgently replicated to the PDC Emulator; if it’s slow or offline, old passwords remain valid on DCs that haven’t received the update
CInfrastructure Master — manages cross-domain password synchronisation
DSchema Master — controls the password schema object attributes

Question 2 of 5

You need to add a new child domain to the forest. The administrator attempts the operation but it fails. Which FSMO role is most likely offline or unreachable?

APDC Emulator
BSchema Master
CRID Master
DDomain Naming Master

Question 3 of 5

Company A (forest: companya.com) and Company B (forest: companyb.com) need users from all domains in both forests to access each other’s resources. Both forests are at Windows Server 2016 functional level. What type of trust should be created?

AExternal trust — creates trust between the root domains of both forests
BShortcut trust — optimises the existing trust path between the two forests
CForest trust — creates a transitive trust between both forests, allowing all domains in each forest to trust all domains in the other
DRealm trust — required for cross-forest authentication on Windows

Question 4 of 5

The DC holding all FSMO roles for your domain has failed catastrophically and cannot be recovered. You plan to seize all FSMO roles to DC02. What is the most important action AFTER seizing the roles?

AEnsure the failed DC never comes back online — clean up its metadata from AD using ntdsutil or Active Directory Users and Computers
BRestart the NETLOGON service on DC02 to activate the newly seized roles
CForce AD replication to all remaining DCs using repadmin /syncall
DReset all user passwords in the domain to clear any RID conflicts

Question 5 of 5

In a multi-domain forest with a Global Catalog server also holding the Infrastructure Master role, cross-domain group membership lookups appear stale. What is the cause?

AGC servers replicate more slowly in multi-domain forests, causing delays
BThe Infrastructure Master needs to be restarted to refresh phantom object references
CCross-domain group lookups always have a 15-minute cache delay by design
DA GC server already has copies of all forest objects and never detects phantom objects as outdated — so it never triggers the Infrastructure Master’s cross-domain update process



🔒

This module is locked — Complete Module 6 and pass its mock test to unlock this module.
Complete the quiz above (70%+) to unlock Module 8: AD Security, Monitoring, Backup & Recovery