Migrate FSMO role to another DC

Hi all,
Recently, we have added additional DC to our domain, and would like to move the FSMO role to the new server (from Server 2008 R2 to Windows Server 2012 R2). Is there any impact to exchange server and/or Lync Server (both are 2013) that we should worry about?
Please advice..
Thanks.

Hello,
Windows Server 2012 R2 domain controllers are fully supported by Exchange 2013 and Lync Server 2013. In addition both Exchange and Lync Servers can discover any Active Directory topology changes so you should be able to move FSMO roles without any issues.
Hope it helps,
Adam
CodeTwo: Software solutions for Exchange and Office 365
If this post helps resolve your issue, please click the "Mark as Answer" or "Helpful" button at the top of this message. By marking a post as Answered, or Helpful you help others find the answer faster.

Similar Messages

What is the impact on an Exchange server when moving FSMO role and schema master into another DC?

What is the impact on an Exchange server when moving FSMO role and schema master into another DC? What do we have to do on exchange after performing a such task?
I had 1 DC (Windows server 2008 R2), 1 Exchange 2010 SP3. I install a new DC (Windows server 2008 R2). I then move all the FSMO role including the schema master role into the NEW DC. I check to be sure that the new DC is a GC as well.
I shutdown the old DC and my Exchange server was not working properly and specially Exchange Management Shell. It start working again after I turn up the older DC.
I am wondering why Exchange did not recognize the new DC, even after moving all the roles on it.
I am looking to hearing from you guys.
Thanks a lot

if you only have 1 DC, you might need to cycle the AD Topology service after shutting the one down.
Also, take a look in the windows logs, there should be an event where Exchange goes to discover Domain Controllers, make sure both are listed there. You can probably force that by cycling AD topology (this will take all services down so be careful
when you do it)
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread

FSMO Roles have moved after migration failure

Hi All
We tried to migrate our SBS2008 to SBS2011 last night but it failed due to the account we were using not having the 'Logon as Batch' right.
We managed to recover the server but now we're getting the following error...
The FSMO Role Check detected a condition in your environment that is out of compliance with the licensing policy. The Management Server must hold the primary domain controller and domain naming master Active Directory roles. Please move the Active Directory
roles to the Management Server now.
How do we rectify this?
Thanks
====
If I run NETDOM QUERY FSMO it all appears fine for all 5 roles but SBS BPA is reporting...
Title: The FSMO role does not comply with the license policy
Source: License Compliance service

Hello ,
Try the following steps to seize FSMo roles.
-Click Start, click Run, type ntdsutil in the Open box, and then click OK.
-Type roles, and then press ENTER.
-Type connections, and then press ENTER.
-Type "connect to server servername ", and then press ENTER, where servername is the name of the domain controller that you want to assign the FSMO role to.
-At the server connections prompt, type q, and then press ENTER.
-Type seize "role" ,
where "role" is the role that you want to seize. For example, to seize the RID master role, type seize rid master. The one exception is for the PDC emulator role, whose syntax is seize pdc, not seize pdc emulator.
-At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.
-if still facing same issue ,please take dcdiag and paste. and Active Directory events.
-For dcdiag ,run dcdiag /v >dc.txt
-paste the output of dc.txt.
All the best.
Upanshu Anand

Migrating FSMO from Server 2003 to 2008 R2

I need to migrate my FSMO 2003 Server role over to 2008 R2.
Server 2003 Name = ma-file 10.1.1.2 - "DC" and "FSMO"
Server 2008 Name = ma-file1 10.1.1.3 - "DC"
I have many applications using the DNS name "ma-file". Mainly our EMR application for storage, ftp, ect... I rather not make any changes to the EMR.
Question1:
Can I simply move FSMO roles from ma-file to ma-file1. Then rename ma-file to something else. Then rename ma-file1 to ma-file. Last step swap IP's. Will this cause any issues? Most importantly will this work?
Question2: Anything need to be done on Exchange 2010 once I move FSMO roles and rename ma-file1 to ma-file?
Thanks for advice!
Dave Santel

I need to migrate my FSMO 2003 Server role over to 2008 R2.
FSMO roles:
Domain Naming Master
PDC Emulator
Infrastructure Master
RID Master
Schema master
----none of these have anything to do with DNS---
moving them from one 2003 domain controller to another 2008 domain controller - will not change anything with DNS.
As i said in my original post, and asked, are you demoting the 2003 server? Or just moving the FSMO roles?
Regards,
Denis Cooper
MCITP EA - MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn:

DCPROMO fails because of FSMO roles...normal solutions not working

I am trying to remove a 2008 R2 DC from our domain but receive this error:
"Directory Service is missing mandatory configuration information...unable to determine ownership of floating single-master operation roles"
In the even log we have this additional error:
Error:
Ownership of the following FSMO role is set to a server which is deleted or does not exist.
Operations which require contacting a FSMO operation master will fail until this condition is corrected.
FSMO Role: CN=Infrastructure,DC=DomainDnsZones,DC=lvcinc,DC=local
FSMO Server DN: CN=NTDS Settings\0ADEL:464a6261-2c82-4ac1-b2b2-144d2e5e1b74,CN=SDOCS1\0ADEL:27fa192a-1f79-4a62-9557-d14ce99406d9,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lvcinc,DC=local
User Action:
1. Determine which server should hold the role in question.
2. Configuration view may be out of date. If the server in question has been promoted recently, verify that the Configuration partition has replicated from the new server recently. If the server in question has been demoted recently and the role transferred, verify that this server has replicated the partition (containing the latest role ownership) lately.
3. Determine whether the role is set properly on the FSMO role holder server. If the role is not set, utilize NTDSUTIL.EXE to transfer or seize the role. This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com.
4. Verify that replication of the FSMO partition between the FSMO role holder server and this server is occurring successfully.
Steps to try resolving:
Investigating the above error - it is referencing a Very old DC from a few years ago "SDOCS1". See bold type above.
1. Ran DCDiag /v /q on all servers and the only errors we receive are the ones that are manifested due to NOT having run the RODC switch with ADPREP
(Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
   Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=ForestDnsZones,DC=lvcinc,DC=local
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
   Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=DomainDnsZones,DC=lvcinc,DC=local
......................... SVHOST2 failed test NCSecDesc
2. Checked the location of the FSMO roles and they are all located on our SDC1 server. I even transferred the Infrastructure FSMO role to a different server and the DCPROMO to remove the server still failed with the same above error.
3. Ran through the "Seizing" of the roles specified by this KB: http://support.microsoft.com/kb/255504. The server mentioned in the error (SDOCS1) doesn't hold any of the roles and isn't listed in the list of servers
3. Went through this KB about removing the metadata of the defunct server: http://support.microsoft.com/kb/216498. The server mentioned doesn't exist in any of the locations.
I'm at a loss as to how to resolve this. Somewhere the AD Database has a reference to that old server (SDOCS1). I have looked in all the obvious places in ADSIEDIT and DNS and have found no reference to it.
I know I can do a force removal of this server (SVHOST2) - but it seems that I need to fix the greater problem of removing the referencen to SDOCS1.
Thanks for any help for this perplexing issue!
-David Miller

I am having a similar problem with our AD structure. My predecessor replaced a failed DC without performing any cleanup afterwards, and my first Monday on the job, our (newer) main AD server corrupted its SAM due to a failed drive and wouldn't login. This
forced me to seize all the roles from the failing server to a secondary DC which was then promoted as our GC server. I'm in the process of migrating to a virtualized environment, and have promoted the VM AD server (AD1), but it fails to demote the other AD
server (Zeus) even though all 5 FSMO roles are now held by AD1. I ran through the suggestions earlier in this thread, and found DCDiag
/v /q  to be most helpful. Piping the results to a text file, I was able to determine that the first failed AD server still exists to some extent in our AD.
   Starting test: KccEvent
   * The KCC Event log test
   A warning event occurred. EventID: 0x8000082B
   Time Generated: 12/07/2010 09:30:04
   Event String:
   Ownership of the following FSMO role is set to a server which is deleted or does not exist.
   Operations which require contacting a FSMO operation master will fail until this condition is corrected.
   FSMO Role: CN=Infrastructure,DC=DomainDnsZones,DC=icucare,DC=local
   FSMO Server DN: CN=NTDS Settings\0ADEL:b59defe5-ba6e-4db4-a738-b24ffd8281b2,CN=WIN-WOI3YAPEZMC\0ADEL:b08771ed-4884-47b8-9b0c-4f2304279843,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=icucare,DC=local
What steps must I take to remove server WIN-W0U3YAPEZMC from our domain? This server no longer exists and I would NEVER give a server a name that I couldn't easily pronounce when discussing it with management :-) I have attempted a metadata cleanup but this
old server is still showing up in our AD, preventing me from demoting an existing AD server so it can be replaced with a newer, virtualized version.
Many thanks for your help.
- Jeff Sepeta, network admin

Changed server for FSMO roles

Hi,
We have moved the FSMO roles from Windows 2008 R2 domain controller to another host with Windows Server 2012 R2. And i guess I also have to change something with the time service also right? Since the PDC role has changed host ? Im not sure, is there a step
by step guide for this...
/Regards Andreas

Here's the link to the MS fix it download.
https://support.microsoft.com/en-us/kb/816042?wa=wsignin1.0
Download the "Configuring the Windows Time service to use an external time source" file to your PDC FSMO role holder and run it. Choose the external time sources of your liking (I use time.nist.gov and pool.ntp.org). I usually let the
time settings at their defaults (3600). This whole process is easy and literally takes 15 seconds. Your domain joined servers and clients will use the new DC as their time source after this. You can verify it's working in the event logs on the
new DC. Good luck.
Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.

Required FSMO Roles to Bring up Domain Controller

I have an unusual situation. Our network team is moving to a new vendor for our WAN circuits and this change which has left our network split. I have 10 domain controllers which can't talk to the other seven domain controllers. This situation
will last about another 2 months.
I have been asked to bring up an RODC domain controller in a location which can't connect to the DC which hosts the FSMO roles, but has communication with seven domain controllers.
Is this possible? What FSMO roles are required to bring up a DC?
Thanks
LRL

In a worse case scenario, replication may fail between domain controllers when a WAN link is re-established:
http://pmeijden.wordpress.com/2011/01/12/domain-replication-has-exceeded-the-tombstone-lifetime/
"This can also happen when your network isn’t working properly or when replication error’s have occurred for to long without anyone noticing them. In large environments it’s possible that a complete site has been disconnected due to unavailable WAN
connections. [...]
The reason why the domain controllers will not continue the replication is because they are protected for so called Lingering Objects. For example, one or more objects that are deleted from Active Directory on all other domain controllers might remain on
the disconnected domain controller. Such objects are called Lingering Objects. Because the domain controller is offline during the entire time that the tombstone is alive, the domain controller never receives replication of the tombstone and therefor doesn’t
know that the object has been deleted."
If your tombstone lifetime is still 60 days (the original default), that is about 2 months.
You can check like this:
http://technet.microsoft.com/en-us/library/cc784932(v=ws.10).aspx
If it is 180 days (new default - I won't go into the details of how and when this changed), you may avoid the worse case scenario. But you still might have problems.
Two months... how much time has already passed?
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

FSMO Roles seem to not transfer

Hello,
We are adding a new Server 08 to our domain. Currently it only has a 03 DC. I setup the new DC, promoted it to a DC, and used the GUI to transfer the PDC, RID Master roles to the new server. I checked it the next day, and when I use teh GUI method
to check the roles, the top box is getting an error, and the second box is still the old value. When i try to change it, it tells me that it can not connect to the PDC. I get this error on both DC's.
When trying with the NTDSUtil tool, i can see the new server having 5 roles, but i only assigned 2. There are no errors when i try with the NTDSUtil tool.
IS the Gui just wrong? Or is there another problem i am not seeing?

FSMO roles are flexible & can be transferred to any DC. Secondly, if you are transferring PDCe role, you need to reconfigure time server role too on the new box going to be hold PDCe role.
Windows Time Server Role In Active Directory Forest/Domain
Please post result of below cmds.
Netdom query dc
Netdom Query FSMO
http://www.techunboxed.com/2012/07/how-to-transfer-fsmo-roles-in-windows.html
Dcdiag will help you to find issues in the existing AD environment.
What does DCDIAG actually… do?
Active Directory Replication Status Tool Released
Awinish Vishwakarma - MVP
My Blog: awinish.wordpress.com
Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

Migrating PDC role from SBS 2008 to Server 2012

Greetings everyone
Are there any special considerations or steps that need be done when elevating my BDC running Server 2012 from a PDC running SBS 2008? We are wanting to remove the SBS machine entirely as we no longer need it and could possibly be of use to one of our clients
down the road.
Thank You
Additional Info: We have already migrated Exchange to the cloud and is no longer hosted on our SBS server. The only function the SBS server has at the moment is being the PDC.

If you haven't seen it already you'll probably want to check out
http://blogs.technet.com/b/infratalks/archive/2012/09/07/transition-from-small-business-server-to-standard-windows-server.aspx which describes the entire process, though obviously in your case you don't need to worry about the Exchnage side of things.
The main thing in your case will moving the FSMO roles over to the new server so the old SBS box is no longer required. There's a link to the process in that blog post, though as I understand it when 2012 is the destination the recommended route is to grab
the roles from 2012 rather than give them up from 2008. There's a good step by step guide to the process here
http://www.waronerrors.com/kb/how-to-transfer-fsmo-roles-from-windows-server-2003--2008-to-windows-server-2012.aspx though obviously the main thing to note is that as soon as you move the FSMO roles you have 21 days in which to complete the migration. After
that time the SBS box will automatically restart periodically (I think after an hour from memory).

Transferring FSMO roles from 2003 DC to 2012 R2 DC - and how exchange will react.

Hi Folks,
I want to transfer the FSMO roles from our current 'PDC' which is server 2003 to a new Server 2012 R2 DC. Im fine with the steps i have to perform to accomplish this but as always, the wildcard is how my exchange 2007 server will react to such a change.
Does anyone have any insight as to whether exchange will just pick up the new 'PDC' without any issues? i am going to leave the domain functional level at 2003 until i am able to migrate to exchange 2013.
thanks.
Colin Stewart

your active directory is a database, if exchange 2007 is working with the current functional level it will work after the roles are moved, the active directory database does not change when you move it to a newer domain controller, it doesn't really change
when you raise the functional level, it changed when you run adprep for a application like exchange 2007, so if it runs now moving roles to new DC will not change that ,raising your functional level will give you more features in AD like recycle
bin which is nice.

How to Check How Many Times FSMO Roles was Changed?

Thanks Gary!

Hello guys!
I'm in a new company and we recently had problems with Primary Domain Controller.
I had need to seize all FSMO roles from a dead server to another.
In the past I read a lot of articles and most of them describe that the best practice is to change de FSMO roles once in life.
I need to know if that is true and if it is a way to know how many times FSMO was changed on a domain.
Thanks in advance,
Marcelo.
This topic first appeared in the Spiceworks Community

Hi, i have a MB Pro Intel C2D with Lion OS and i migrated the user to another MB Pro i5 Lion, after migrating I'm having a problem on Safari, it won't open and just crashing

Hi, i have a MB Pro Intel C2D with Lion OS and i migrated the user to another MB Pro i5 Lion, after migrating I'm having a problem on Safari, it won't open and just crashing

Shouldn't be having a problem, then. That's the version for ML. Try taking your question to the Safari forum - https://discussions.apple.com/community/mac_os/safari - that's where all the Safari experts hang out.
Clinton

How do I migrate one mac to another and have it look just like it did on the other machine on the one I migrated it to?

I need to migrate a mac to another and have kept my backups current with timemachine. I connected the HD with the time machine back ups to the machine I'm migrateing to and used the migratiation assastiant but now i have 2 accounts and no permissions to access the account I migrated. I just imagined I would use the migration assastiant and afterwards I'd be looking at the mac I transfered/migrated. What did I do wrong or how can I achieve the desired effect?
Thank you in advance. Jay

i have 2 accounts and no permissions to access the account I migrated.
What do you mean by this? Have you tried to login to these accounts?
If you come up automatically to an account, you can log off this account then login to a new account.
Robert

Is It Possible to Add a Fileserver to a DFS Replication Group Without Connectivity to FSMO Roles Holder DC But Connectivity to Site DC???

I apologize in advance for the rambling novella, but I tried to include as many details ahead of time as I could.
I guess like most issues, this one's been evolving for a while, it started out with us trying to add a new member
to a replication group that's on a subnet without connectivity to the FSMO roles holder. I'll try to describe the
layout as best as I can up front.
The AD only has one domain & both the forest & domain are at 2008R2 function level. We've got two sites defined in
Sites & Services, Site A is an off-site datacenter with one associated subnet & Site B with 6 associated subnets, A-F.
The two sites are connected by a WAN link from a cable provider. Subnets E & F at Site B have no connectivity to Site A
across that WAN, only what's available through the front side of the datacenter through the public Internet. The network
engineering group involved refuses to route that WAN traffic to those two subnets & we've got no recourse against that
decision; so I'm trying to find a way to accomplish this without that if possible.
The FSMO roles holder is located at Site A. I know that I can define a Site C, add Subnets E & F to that site, & then
configure an SMTP site link between Sites A & C, but that only handles AD replication, correct? That still wouldn't allow me, for example,
to enumerate DFS namespaces from subnets E & F, or to add a fileserver on either of those subnets as a member to an existing
DFS replication group, right? Also, root scalability is enabled on all the namespace shares.
Is there a way to accomplish both of these things without transferring the FSMO roles from the original DC at Site A to, say,
the bridgehead DC at Site B?
When the infrastructure was originally setup by a former analyst, the topology was much more simple & everything was left
under the Default First Site & no sites/subnets were setup until fairly recently to resolve authentication issues on
Subnets E & F... I bring this up just to say, the FSMO roles holder has held them throughout the build out & addition of
all sorts of systems & I'm honestly not sure what, if anything, the transfer of those roles will break.
I definitely don't claim to be an expert in any of this, I'll be the first to say that I'm a work-in-progress on this AD design stuff,
I'm all for R'ing the FM, but frankly I'm dragging bottom at this point in finding the right FM. I've been digging around
on Google, forums, & TechNet for the past week or so as this has evolved, but no resolution yet.
On VMs & machines on subnets E & F when I go to DFS Management -> Namespace -> Add Namespaces to Display..., none show up
automatically & when I click Show Namespaces, after a few seconds I get "The namespaces on DOMAIN cannot be enumerated. The
specified domain either does not exist or could not be contacted". If I run a dfsutil /pktinfo, nothing shows except \sysvol
but I can access the domain-based DFS shares through Windows Explorer with the UNC path \\DOMAIN-FQDN\Share-Name then when
I run a dfsutil /pktinfo it shows all the shares that I've accessed so far.
So either I'm doing something wrong, or, for some random large, multinational company, every sunbet & fileserver one wants
to add to a DFS Namespace has to be able to contact the FSMO roles holder? Or, are those ADs broken down with a child domain
for each Site & a FSMO roles holder for that child domain is located in each site?

Hi,
A DC in siteB should helpful. I still not see any article mentioned that a DFS client have to connect to PDC every time trying to access a DFS domain based namespace.
Please see following article. I pasted a part of it below:
http://technet.microsoft.com/en-us/library/cc782417(v=ws.10).aspx
Domain controllers play numerous roles in DFS:
Domain controllers store DFS metadata in Active Directory about domain-based namespaces. DFS metadata consists of information about entire namespace, including the root, root targets, links, link targets, and settings. By default,root servers
that host domain-based namespaces periodically poll the domain controller acting as the primary domain controller (PDC) emulator master to obtain an updated version of the DFS metadata and store this metadata in memory.
So Other DC needs to connect PDC for an updated metadata.
Whenever an administrator makes a change to a domain-based namespace, the
change is made on the domain controller acting as the PDC emulator master and is then replicated (via Active Directory replication) to other domain controllers in the domain.
Domain Name Referral Cache
A domain name referral contains the NetBIOS and DNS names of the local domain, all trusted domains in the forest, and domains in trusted forests. A
DFS client requests a domain name referral from a domain controller to determine the domains in which the clients can access domain-based namespaces.
Domain Controller Referral Cache
A domain controller referral contains the NetBIOS and DNS names of the domain controllers for the list of domains it has cached. A DFS client requests a domain controller referral from a domain controller (in the client’s domain)
to determine which domain controllers can provide a referral for a domain-based namespace.
Domain-based Root Referral Cache
The domain-based root referrals in this memory cache do not store targets in any particular order. The targets are sorted according to the target selection method only when requested from the client. Also, these referrals are based on DFS metadata stored
on the local domain controller, not the PDC emulator master.
Thus it seems to be acceptable to have a disconnect between sites shortly when cache is still working on siteB.
If you have any feedback on our support, please send to [email protected].

Is it Possible to Promote DC on a Subnet With Connectivity to a Site DC But Not DC with FSMO Roles???

I apologize in advance for the rambling novella, but I tried to include as many details ahead of time as I could.
I guess like most issues, this one's been evolving for a while, it started out with us trying to add a new member
to a replication group that's on a subnet without connectivity to the FSMO roles holder. I'll try to describe the
layout as best as I can up front.
The AD only has one domain & both the forest & domain are at 2008R2 function level. We've got two sites defined in
Sites & Services, Site A is an off-site datacenter with one associated subnet & Site B with 6 associated subnets, A-F.
The two sites are connected by a WAN link from a cable provider. Subnets E & F at Site B have no connectivity to Site A
across that WAN, only what's available through the front side of the datacenter through the public Internet. The network
engineering group involved refuses to route that WAN traffic to those two subnets & we've got no recourse against that
decision; so I'm trying to find a way to accomplish this without that if possible.
The FSMO roles holder is located at Site A. I know that I can define a Site C, add Subnets E & F to that site, & then
configure an SMTP site link between Sites A & C, but that only handles AD replication, correct? That still wouldn't allow me, for example,
to enumerate DFS namespaces from subnets E & F, or to add a fileserver on either of those subnets as a member to an existing
DFS replication group, right? Also, root scalability is enabled on all the namespace shares.
Is there a way to accomplish both of these things without transferring the FSMO roles from the original DC at Site A to, say,
the bridgehead DC at Site B?
When the infrastructure was originally setup by a former analyst, the topology was much more simple & everything was left
under the Default First Site & no sites/subnets were setup until fairly recently to resolve authentication issues on
Subnets E & F... I bring this up just to say, the FSMO roles holder has held them throughout the build out & addition of
all sorts of systems & I'm honestly not sure what, if anything, the transfer of those roles will break.
I definitely don't claim to be an expert in any of this, I'll be the first to say that I'm a work-in-progress on this AD design stuff,
I'm all for R'ing the FM, but frankly I'm dragging bottom at this point in finding the right FM. I've been digging around
on Google, forums, & TechNet for the past week or so as this has evolved, but no resolution yet.
On VMs & machines on subnets E & F when I go to DFS Management -> Namespace -> Add Namespaces to Display..., none show up
automatically & when I click Show Namespaces, after a few seconds I get "The namespaces on DOMAIN cannot be enumerated. The
specified domain either does not exist or could not be contacted". If I run a dfsutil /pktinfo, nothing shows except \sysvol
but I can access the domain-based DFS shares through Windows Explorer with the UNC path \\DOMAIN-FQDN\Share-Name then when
I run a dfsutil /pktinfo it shows all the shares that I've accessed so far.
So either I'm doing something wrong, or, for some random large, multinational company, every sunbet & fileserver one wants
to add to a DFS Namespace has to be able to contact the FSMO roles holder? Or, are those ADs broken down with a child domain
for each Site & a FSMO roles holder for that child domain is located in each site?

Hi Matthew,
Unfortunately a lot of the intricacies of DFS leave my head as soon as I’m done with a particular design or troubleshooting situation but from memory, having direct connectivity to the PDC emulator for a particular domain is the key to managing domain based
DFS.
Have a read of this article for the differences between “Optimize for consistency” vs “Optimize for scalability”:
http://technet.microsoft.com/en-us/library/cc737400(v=ws.10).aspx
In brief, I’d say they mean:
In consistency mode the namespace servers always poll the PDCe for the latest and greatest information on the namespaces they are hosting.
In scalability mode the namespace servers should poll the closest DC for information on the namespaces they are hosting.
The key piece of information in that article about scalability mode is: “Updates are still made to the namespace object in Active Directory on the PDC emulator, but namespace servers do not discover those changes until the updated namespace object replicates
(using Active Directory replication) to the closest domain controller for each namespace server.”
I read that as saying you can have a server running DFS-N as long as it has connectivity to a DC but if you want to make changes, do them from a box that has direct connectivity to the PDCe. Then let AD replication float those changes out to your other DCs
where the remote DFS-N server will eventually pick them up. Give it a try and see how you get on.
That being said, you may want to double check that you have configured the most appropriate FSMO role placement in your environment's AD design:
http://technet.microsoft.com/en-us/library/cc754889(v=ws.10).aspx
And a DFS response probably wouldn’t be complete without an AskDS link:
http://blogs.technet.com/b/askds/archive/2012/07/24/common-dfsn-configuration-mistakes-and-oversights.aspx
These links may also help:
http://blogs.technet.com/b/filecab/archive/2012/08/26/dfs-namespace-scalability-considerations.aspx
http://blogs.technet.com/b/josebda/archive/2009/12/30/windows-server-dfs-namespaces-reference.aspx
http://blogs.technet.com/b/josebda/archive/2009/06/26/how-many-dfs-n-namespaces-servers-do-you-need.aspx
I hope this helps,
Mark

Migrate FSMO role to another DC

Similar Messages

Maybe you are looking for