B04 70-640 Configuring and Modifying Domains and Forests

Domain Name System

Flexible Single Master Operations

To ensure consistency of the schema and to prevent conflicting updates into the AD database, AD employs the Flexible Single Master Operations (FSMO) role – or operations master.

This is a DC containing roles that affect only the domain in which it's located or only the forest in which that domain is contained

Domain Naming Master

Schema Master

Primary Domain Controller (PDC) Emulator

Infrastructure Master

Relative Identifier (RID) Master

The Domain Naming Master role manages the structure of a forest and enables restructuring of all domains except the forest root domain. It adds, removes, or renames domain and directory partitions, and replicates updates to existing partitions to all DCs. It can also add or remove cross-referenced objects in directories that are external to the forest.

Domain Naming Master is a per-forest role – only one DC in an entire forest holds the role.

The Schema Master role performs all modifications and updates to the AD schema. It checks the types and attributes of schema objects entered in the forest, and enables replication of all changes to other DCs in the forest.

Schema Master is a per-forest role, so it's installed on only one DC in a forest.

The PDC Emulator role manages both time synchronization and account lockout in a domain. It also processes password changes and authenticates Windows NT logons. This is a per-domain role – it must be installed on a DC within each domain.

When an object in a domain is moved, the Infrastructure Master role updates references to the object in other domains, and uses the replication process to update all the DCs in its domain.

An object reference constrains the Global Unique Identifier (GUID), the Security Identifier (SID), and the distinguished name of the object that is referenced.

The Infrastructure Master role is a per-domain role – it must be installed on a DC in each domain.

In response to requests from the DCs in a domain, the RID Master role assigns a block of RIDs to each DC. Each RID uniquely identifies a group in a domain.

The RID Master role is a per-domain role – it must be installed on a DC in each domain.

To do this, you

* leave the operations master roles on the first domain controller in the regional domain.

* ensure that the regional domain controller is not a global catalog server.

* deploy another domain controller to the domain on which the first domain controller is deployed. This additional domain controller will be the standby operations master.

* host the Primary Domain Controller (PDC) emulator operations master role on a powerful and reliable domain controller. This ensures that it has the availability and capacity to handle the workload.

The Domain Naming Master and Schema Master roles are assigned to the first domain controller (DC) of a forest

the Primary Domain Controller (PDC) Emulator, Infrastructure Master, and Relative Identifier (RID) Master roles are assigned to the first DC of each domain