MCITP 70-640: Seizing roles

Active Directory has five operational master roles that can be transferred from domain controller to domain controller as required. Check out http://itfreetraining.com or http://youtube.com/ITFreeTraining for more of our always free training videos. In some cases the role may not be able to be transferred; for example, if the hardware on the domain controller was to fail, a transfer cannot be made. When this occurs, the operational master role must be seized. This video looks at how to seize an operational master role, clean up the Active Directory database afterwards, and recover a server that has had an operational master role seized.

Demo seizing the role 04:40
Demo cleaning up the Active Directory database 08:55
Demo removing Active Directory from a recovered server 14:04

What is an operational master role?
See our operational master role video for more information. http://itfreetraining.com/70-640/oper...

Impact of missing operational master role
Seizing an operational master role from a failed server is a drastic step. Once complete, the domain controller can not be started back up on the network. Before seizing the operational master role, first consider the effect the missing operational master role will have as listed below.
Schema master: If this role is missing then changes will not be able to be made to the Active Directory schema. The schema defines the design of the Active Directory database. If you are not planning on making changes to the structure of the Active Directory database this role could be off line indefinitely.
Domain Naming Master: This is required when adding/removing domains. If you are not adding or removing domains the Domain Naming Operational Master Role could be offline indefinitely.
Relative ID Master: Otherwise known as RID master, it allocates RID's to Domain Controllers. These are used to create Active Directory objects. Without RID's Domain Controllers cannot create new objects. RID's are allocated in pools so a domain controller will not run out quickly unless a lot of Active Directory objects are created at once.
PDC Emulator: A PDC emulator is considered the final authority on password authentication. If the PDC emulator is down, a user may experience problems logging in just after a password change. Short outage should not be problem but it is recommended to try to recover the domain controller holding the PDC emulator quickly if it fails.
Infrastructure master: In a single domain/forest environment, a missing infrastructure master will not cause any problems. In a multiple domain environment, this will only cause problems if none of your domain controllers are global catalog servers. If this is the case, cross domain objects may not be updated correctly when changed.

Seizing a role
Seizing a role is considered a last resort and once completed the domain controller that was holding that operational master role will not be able to be started back up on the network again. A domain controller that can have an operational master role transferred or seized is often referred to as a standby operational master.
In order to seize an operational master role, you need to run the command NTDSUtil from the command prompt. Once inside the tool, run the following commands.
roles
connections
connect to server (Domain controller role will be seized by)
quit
Seize PDC|RID master|schema master|infrastructure master|naming master

Removing Domain Controller Configuration
Once you seize the operational master role, the configure data for that domain controller will still exist in Active Directory. This can be removed by performing the following steps.
Run NTDSUtil from the command prompt
metadata cleanup
connect to server (any domain controller)
quit
select operational target
list domain
select domain (your domain number shown in list domain)
list sites
select site (your site number shown in list sites)
list servers in site
select server (your server number shown in list servers in site)
quit
Remove selected server
Quit NTDSUtil
Run Active Directory Sites and Services from administrative tools
Find the record for your failed domain controller. It should not have domain listed next to its name. Press delete to delete the record.

Reusing a failed server
If you have seized an operational master role from a domain controller and later recover the domain controller, Active Directory will need to be removed from the domain controller before it can be added and reused on the domain. This can be done with the following step.
Make sure the server is not connected to the network.
From the command line run DCPromo /ForceRemoval

1. seizing definition, seizing meaning, seizing synonym, seizing the moment, seizing the means of production, seizing up, seizing every opportunity, seizing the day, seizing the opportunity, seizing seizure, seizing wire, seizing property, seizing chocolate, seizing property as evidence is an example of, seizing the light, seizing assets, seizing dog, seizing your divine moment, seizing in spanish, seizing the means of reproduction, operations master roles, operation master roles server 2012, operations master roles 2012, operation master roles in active directory 2012, operation master roles transfer, operation master roles best practices, operations master roles show error, operation master roles error, operations master roles command line, operation master roles seize, operations master roles 2008 r2, operations master roles 2003, transfer operations master roles server 2012, change operation master roles 2012, ad operation master roles, check operation master roles, five operations master roles, 5 operation master roles, the operations master roles held by this directory server, change operation master roles 2008, fsmo roles, fsmo roles query, famous footwear, fsmods17, fsmo query, movies, famous birthdays, fsmo roles 2016, fsmo roles command, fsmo roles transfer, fsmo roles 2012 r2, famotidine, fsmoroleowner, fsmo roles best practice, fsmo roles in active directory, sfmoto, fsmo roles 2012, famous people, modinstaller, fsmo role placement, active directory users and computers, active directory windows 10, active directory domain services, active directory administrative center, active directory federation services, active directory tutorial, active directory tools, active directory ou, active directory ports, active directory recycle bin, active directory download, active directory certificate services, active directory password policy, active directory certification, active directory forest, active directory lightweight directory services, active directory powershell module, active directory ldap, active directory for dummies, active directory management tools, \u003d -570, 70-640 exam, 70-640 certification, 70-640 pdf, 70-640 study guide pdf, 70-640 exam questions pdf, 70-640 pdf ebook, mcitp systems administrator, mcitp vs mcse, mcitp-ea, mcitp enterprise administrator, mcitp server administrator, mcitp 70-640, mcitp salary, mcitp certification course, mcitp microsoft, mcitp practice test, mcitp jobs, mcitp windows 10, mcitp meaning, mcitp family support network, mcitp logo, mcitp replacement, mcitp certification cost, mcitp mcps, mcitp 2008, mcitp mcse mcts, mcts real time, mcts tracker, mctsib, mcts m card, mctssa, mcts route 15, mcts trip planner, mcts bus, mcts route 76, mcts route 27, mcts green line, mcts route 14, mcts route 30, mcts route 19, mcts gold line, mcts route 67, mcts route 23, mcts app, mcts next, mcts 80, itfreetraining youtube, itfreetraining active directory, itfreetraining adfs, itfreetraining dns, itfreetraining 70-410, itfreetraining windows server 2016, itfreetraining windows server 2012, itfreetraining vmware, itfreetraining 70-640, itfreetraining powershell, itfreetraining windows 7, itfreetraining windows 10, itfreetraining hyper v, itfreetraining group policy, itfreetraining groups, itfreetraining dfs, itfreetraining sccm, itfreetraining certificate, itfreetraining linux, itfreetraining 70-411

MCITP 70-640: Seizing roles
73,032 views views	followers
289 Likes	289 Dislikes
Education	Upload TimePublished on 27 Dec 2011