How to Transfer FSMO Roles (2 Easy Steps)

Do you need to transfer FSMO roles to another domain controller?

No problem, it is very is to do.

In this tutorial, I’ll show you step-by-step instructions to transfer the FSMO roles from one domain controller to another. I’ll show you two methods: the first is using PowerShell and the second is using the ADUC GUI.

Why Transfer FSMO roles?

By default, when Active Directory is installed all five FSMO roles are assigned to the first domain controller in the forest root domain. Transferring FSMO roles is often needed for several reasons including:

It is recommended to only transfer FSMO roles when the current role holder is operational and is accessible on the network. For a complete list of considerations see the MS article Transfer or seize FSMO Roles in Active Directory Services.

Step 1: List Current FSMO Role Holders

Before moving the FSMO roles it is a good idea to check which domain controllers hold which roles.

You can list which domain controllers hold FSMO roles with these two PowerShell commands:

Get domain level FSMO roles

get-addomain | select InfrastructureMaster, PDCEmulator, RIDMaster

Get forest level FSMO roles

Get-ADForest | select DomainNamingMaster, SchemaMaster

Below is a screenshot of the results in my domain.

get fsmo roles

List of installed roles in my domain:

  • InfrastructureMaster is on DC1
  • PDCEmulator is on DC2
  • RIDMaster is on DC2
  • DomainNamingMaster is on DC1
  • Schemamaster is on DC1

I want to move all the roles from DC2 to DC1, I’ll demonstrate this below.

Step 2: Transfer FSMO Roles

I’ll first demonstrate transferring roles with PowerShell, it is by far the easier option of the two (in my opinion).

You want to log into the server that you will be transferring the roles to, in my case it is DC1.

To move a role with PowerShell you will use the Move-ADDirectoryServerOperationMasterRole cmdlet, then the hostname of the server to transfer to.

Transfer PDCEmulator

Move-ADDirectoryServerOperationMasterRole -Identity "dc1" PDCEmulator

Transfer RIDMaster

Move-ADDirectoryServerOperationMasterRole -Identity "dc1" RIDMaster

Transfer InfrastrctureMaster

Move-ADDirectoryServerOperationMasterRole -Identity "dc1" Infrastructuremaster

Transfer DomainNamingMaster

Move-ADDirectoryServerOperationMasterRole -Identity "dc1" DomainNamingmaster

Transfer SchemaMaster

Move-ADDirectoryServerOperationMasterRole -Identity "dc1" SchemaMaster

Here is a screenshot of when I moved PDCEmulator and RIDMaster to DC1.

transfer fsmo roles with powershell

Now if I re-run the commands to list the FSMO roles I should see them all on DC1.

list fsmo roles again

Yes, I have confirmed all the roles are now on DC1. As you can see moving FSMO roles with PowerShell is very easy to do.

Now let’s see how to transfer FSMO roles using the Active Directory Users and Computers GUI.

Transfer FSMO Roles Using ADUC GUI

Just like PowerShell you need to log into the server that you will be transferring to. I’m transferring from DC2 to DC1 so I’ll log into DC1.

Open the Active Directory Users and Computers console, then right-click on the domain and click on operations masters.

move operations masters roles with GUI

You should now see a screen with three tabs (RID, PDC, and Infrastructure).

transfer RID role with gui

To transfer one of these roles just click on the change button. You can’t select which domain controller to transfer the role to, that is why you need to log into the server that you want to transfer to. if I wanted to transfer the RID role to DC3 I would log into that server.

To transfer the domain naming operations master role you will need to open Active Directory Domains and Trusts. Right-click on “Active Directory Domains and Trusts” and select “Operations Master”.

move operations master role with gui

Now click change to transfer the role to another DC.

moving roles

To transfer the schema master role follow these steps.

Open a command line and run the command regsvr32 schmmgmt.dll

register schmngmt.dll

Next, you need to open an MMC console. To do this click on start then type mmc. and click the icon.

open mmc console

Next, click File, then Add/Remove Snap-in

add remove to mmc console

Add “Active Directory Schema” from the list and click ok.

add active directory schema to mmc console

Right click on “Active Directory Schema” and change the domain controller to the server you want to transfer the role to.

In this example, I’ll change the domain controller to DC2.

Now you can right-click on Active Directory schema and select “Operations Master” to transfer the schema master role.

Confirm the role is changing to the correct DC and click the “change” button.

As you can see transferring FSMO roles with the GUI takes a lot of extra steps and that is why I prefer to use PowerShell. But if you are not into Powershell then the GUI works just fine.

Summary

Moving FSMO roles to another server is not a daily task but is necessary at times. Microsoft recommends the server be online when moving roles. The steps in this tutorial should help you when it comes time to move roles.

23 thoughts on “How to Transfer FSMO Roles (2 Easy Steps)”

  1. We have a Parent domain (five FSMO roles) and a child domain with holding three roles (PDC, RID and IM). I am planning to move FSMO roles on parent domain to a new domain controller, so do I need anything to do or check on child domain controllers before I move the roles on parent? Any expected issue after FSMO roles move on child domain?

    Reply
  2. Hi Robert
    Many thanks for this perfect guide. I upgraded a windows server 2008 DC to windows 2019 by your incredible article without facing any major issue.
    thanks again.

    Reply
  3. Quick question … prior to doing this, was the Server that “will be” the new DC promoted as a domain controller.

    For example, ours current DC is a 2008R2 physical server, old and getting away from it. We built a new virtual Server 2022, and installed all the ADDS, DNS, DHCP, etc .. roles. Do we promote to domain controller FIRST before we begin the above steps?

    Reply
      • In reference to Transferring Roles from old DC to new DC … will the client computers get NEW profiles, or will they keep the same desktop profiles? Would hate to do all this, and when logging into new domain, we have to redo everything. Trying to avoid this.

        Also, how does this affect the user data on the server? The map drives will all have the old location, unless resigning into the new domain rewrites the maps?

        Reply
        • Computers will keep the same profiles. If the old DC is running other services or apps (file server, print server, DHCP) you will need to migrate them to another server before shutting it down.

          Reply
  4. Thank you Allen, My question is, we have DC01 with Windows Server 2012R2 in Azure, using that all our Office Local DCs was configured (Promoted using Azure DC01), due to AAD sync issue, we have configured another DC in Azure DC02 with windows Server 2016 and Promoted using Azure DC01 and configured AAD Connector.
    Now, we have move FSMO from Azure DC01 to Azure DC02 and then Shut down Azure DC01.
    when we doing this, how did our Local Office DC will automatically take Root DC as Azure DC02 or we have to demote all Local DCs from Azure DC01 and again Promote using Azure DC02? This is my Question, Please clarify. Thank You.

    Reply
    • When the roles are moved, the other active domain controllers within the domain/forest will see the changes. And it doesn’t matter which DC you used to promote new ones, once they are part of the domain, they’re all equals.

      Back in the day I had to seize the FSMO roles from a crashed domain controller and the remaining active ones happily accepted the DC that seized the roles as the new FSMO role holder.

      Reply
  5. when we change FSMO to DC1, how to handle Local AD Servers which already Promoted using DC02, it’s all automatically sync with DC02 or we need to demote and promote with using DC01

    Reply
  6. The schema master GUI instruction is incorrect.
    You need to change Active Directory Domain Controller first and then to the Operations Master moving step.

    Reply

Leave a Comment