Scenario: a large, multiple site, enterprise with over 10 domain controllers and a single domain controller holding all of the FSMO. Question: Is there any benefit to moving the FSMO to another domain controller prior to patching a domain controller that holds all of the FSMO roles? Is there any benefit or reduction in risk?

Not really, active directory is now multi-master, in a worst case you can seize roles to another healthy one. https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-operation-master-roles-in-ad-ds --please don't forget to upvote and Accept as answer if the reply is helpful--

Patching a domain controller with all the FSMO roles in a large enterprise

Accepted answer

Anonymous

2023-06-29T14:12:25.0766667+00:00

Not really, active directory is now multi-master, in a worst case you can seize roles to another healthy one.

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-operation-master-roles-in-ad-ds

--please don't forget to upvote and Accept as answer if the reply is helpful--
Please sign in to rate this answer.
Anonymous

2023-06-30T12:16:16.3633333+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Lance Candia 20 Reputation points

2023-06-30T13:08:47.7133333+00:00

The brief answer you offered was reasonable and the same as all of my team members. You may actually find this interesting and a little bit ironic. Another person offered an answer and admitted it was from chatGPT. A machine offered a more concise and detailed answer. I would love to have the sources cited for the answer but it's probably a culmination of many sources in its database. This is the world we live in now. In any case, thanks for your response. - Lance (Regards from Stuttgart, Germany)

Subject: Patching domain controllers in a large environment

I have a Microsoft multiple site enterprise with over 10 domain controllers

and a single domain controller holding all of the FSMO roles. Does it make

sense to move the FSMO role to another server before patching the domain controller?

When it comes to patching a domain controller (DC) in a Microsoft multiple-

site enterprise with over 10 domain controllers and a single DC holding all

of the Flexible Single Master Operations (FSMO) roles, it's generally

recommended to move the FSMO roles to another domain controller before

patching.

The FSMO roles are crucial for the proper functioning of Active Directory,

and they control various operations within the domain, such as schema

updates, domain naming, and more. By moving the FSMO roles before patching,

you minimize the potential impact on the operations of your domain and

reduce the risk of any issues during the patching process.

Moving the FSMO roles involves transferring them to another domain

controller using the appropriate administrative tools provided by

Microsoft, such as the Active Directory Users and Computers console or the

NTDSUTIL command-line tool. Once the roles have been successfully

transferred, you can proceed with patching the domain controller without

worrying about disruptions to the FSMO operations.

It's worth mentioning that while it's generally recommended to move FSMO

roles before patching, there might be scenarios where the risk or impact of

patching a domain controller is low enough that it can be done without

transferring the roles. However, as a best practice, especially in larger

enterprise environments, it's advisable to err on the side of caution and

move the FSMO roles to ensure smooth operations during the patching process.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Patching a domain controller with all the FSMO roles in a large enterprise

1 additional answer

Your answer