How to Seize schema master

Racheal 226

HI ,

I need to change FSMO role owner of my AD LDS instance

I have created replication between old servers (a/B) and new servers (c/d)

C is having FSMO role ownwe as A . How can i change it?

when i tried Move-ADDirectoryServerOperationMasterRole command it throws error

Move-ADDirectoryServerOperationMasterRole : Cannot find directory server with identity: 'xx-xx-xx'.

Any help to change FSMO roles will be much appreciated.

Thanks in advance

8 answers

Dave Patrick 426K Reputation points MVP

2021-04-01T17:47:50.69+00:00

You can follow along here to seize roles to another healthy domain controller.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-fsmo-roles-in-ad-ds

--please don't forget to Accept as answer if the reply is helpful--
Please sign in to rate this answer.
Racheal 226 Reputation points

2021-04-01T18:17:04.703+00:00

HI @Dave Patrick , Thanks for the reply! Yes am following that page but I'm facing below issue . ![83791-fsmo.png][1] need to change FSMO roles in schema as attached from 9002000xxxx to SOK-24-xxxx S C:\windows\system32> Move-ADDirectoryServerOperationMasterRole -Identity SOK-24-xxxx$Uxxxxxx -OperationMas erRole domainnamingmaster -Force ove-ADDirectoryServerOperationMasterRole : Unable to find a default server with Active Directory Web Services running. t line:1 char:1 Move-ADDirectoryServerOperationMasterRole -Identity SOK-24-xxxx$Uxxxxxx ... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ResourceUnavailable: (SOK-24-34-15:ADDirectoryServer) [Move-ADDirector...ationMasterRole ], ADServerDownException + FullyQualifiedErrorId : ActiveDirectoryServer:1355,Microsoft.ActiveDirectory.Management.Commands.MoveADDirectory ServerOperationMasterRole [1]: /api/attachments/83791-fsmo.png?platform=QnA
Sign in to comment
Dave Patrick 426K Reputation points MVP

2021-04-01T18:26:15.99+00:00

I'd check this one.
https://theitbros.com/unable-to-find-a-default-server-with-active-directory-web-services-running/

--please don't forget to Accept as answer if the reply is helpful--
Please sign in to rate this answer.
Racheal 226 Reputation points

2021-04-03T07:37:07.657+00:00

HI @Dave Patrick ,

Thanks for the link.

I tried those commands

PS C:\windows\system32> Import-Module ActiveDirectory
PS C:\windows\system32>
Err occur from below command only

PS C:\windows\system32> Move-ADDirectoryServerOperationMasterRole -Identity SOK-24-xxxx$Uxxxxxx -OperationMasterRole
schemaMaster -Server SOK-24-xxxx:50000
Move-ADDirectoryServerOperationMasterRole : Cannot find directory server with identity: 'SOK-24-xxxx'.
At line:1 char:1

Move-ADDirectoryServerOperationMasterRole -Identity SOK-24-xxxx$Uxxx ...

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CategoryInfo : ObjectNotFound: (SOK-24-xxxx:ADDirectoryServer) [Move-ADDirector...ationMasterRole], ADIdentityNotFoundException

FullyQualifiedErrorId : ActiveDirectoryCmdlet:Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException,Microsoft.ActiveDirectory.Management.
Commands.MoveADDirectoryServerOperationMasterRole
Sign in to comment
Fan Fan 15,291 Reputation points Microsoft Vendor

2021-04-02T01:09:24.963+00:00

Hi,

Welcome to share here!

Did you tried to use the Ntdsutil to seize or transfer roles?
Still any errors?
If there are any progresses ,welcome to share here!
Best Regards,
Please sign in to rate this answer.
Racheal 226 Reputation points

2021-04-03T07:38:59.867+00:00

hi @Fan Fan

Yes i tried but i get below message so i tried powershell method.

C:\Windows\System32>Ntdsutil
'Ntdsutil' is not recognized as an internal or external command,
operable program or batch file.

My issue is my AD LDS instance schema still referring to old server even after replication is stopped.

Thanks
Sign in to comment
Dave Patrick 426K Reputation points MVP

2021-04-03T13:15:38.657+00:00

'Ntdsutil' is not recognized as an internal or external command,

Are you trying from another healthy domain controller?
Please sign in to rate this answer.
Racheal 226 Reputation points

2021-04-05T20:52:25.817+00:00

Hi @Dave Patrick , ntdsutil.exe is missing. ![84632-ntds.png][1] [1]: /api/attachments/84632-ntds.png?platform=QnA Are you trying from another healthy domain controller? Am trying in new server C. because C has the schema from A and when i check replication between C & D C default web site shows A C:\>repadmin /showrepl localhost:50000 Default-First-Site-Name**Server-A$instance1** DSA Options: (none) Site Options: (none) Thanks in advance.
Sign in to comment
Dave Patrick 426K Reputation points MVP

2021-04-05T21:02:26.487+00:00

Please run (old servers);

Dcdiag /v /c /d /e /s:%computername% >c:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt

then put unzipped text files up on OneDrive and share a link.
Please sign in to rate this answer.
Racheal 226 Reputation points

2021-04-06T07:04:16.27+00:00

Hi @Dave Patrick ,

There are some DC issue between old and new server as discussed here

As per Infra team, old servers has some vulnerability protocol and that has been disabled in new server so connectivity fails.
so I have done the below steps in new server

deleted replica instance

created new AD LDS instance

took backup of data file from old server and pasted in new server

created replication between new server C & D

checked replication in Server C & D but server C still has dafault first site mapped to old server A

checked Schema master for FSMO roles from ADSI EDIT but it has FSMOroleOwner as old server A
7.while trying to seize the schema roles am getting this issue

Here is the one drive link

Thanks.
Sign in to comment