FSMO Roles Explained: The 5 Active Directory Roles

FSMO roles are five special jobs in Active Directory that only one domain controller can perform at a time. Two apply to the whole forest (Schema Master and Domain Naming Master) and three apply to each domain (PDC Emulator, RID Master and Infrastructure Master). You can view all five with netdom query fsmo, and move them with PowerShell when a domain controller is retired.

What Are FSMO Roles in Active Directory?

FSMO (Flexible Single Master Operations) roles are tasks that would cause conflicts if several domain controllers did them at once, so Active Directory assigns each one to a single server. Most directory changes use multi-master replication, meaning any domain controller (DC) can accept an update and replicate it to the others. A few operations, such as changing the schema or handing out unique security IDs, cannot safely work that way.

Microsoft also calls them operations master roles. The word "flexible" refers to the fact that you can move a role from one DC to another; the "single master" part means only one DC holds it at any moment.

What Are the 5 FSMO Roles?

The five roles split into two forest-wide roles, which exist once per forest, and three domain-wide roles, which exist once in every domain.

A SID (security identifier) is the unique number Windows uses to identify an account; it is built from the domain's identifier plus a RID. That is why the RID Master matters: without fresh RID pools, DCs eventually cannot create new accounts.

How Do You Query FSMO Roles?

The quickest way to query FSMO roles is to run netdom query fsmo from an elevated Command Prompt on a domain controller or a machine with the AD DS tools installed. It prints all five roles and the DC that holds each one.

1. Sign in to a domain controller, or a workstation with Remote Server Administration Tools (RSAT) for AD DS.
2. Open Start, type cmd, right-click Command Prompt and choose Run as administrator.
3. Run netdom query fsmo.
4. Read the output: one line per role, each followed by the fully qualified name of its current holder.

If you prefer the graphical tools, each role is shown in a different console: Active Directory Users and Computers for the RID, PDC and Infrastructure roles (right-click the domain, then Operations Masters), Active Directory Domains and Trusts for the Domain Naming Master, and the Active Directory Schema snap-in for the Schema Master. The schema snap-in is hidden until you register it with regsvr32 schmmgmt.dll.

How Do You Show FSMO Roles with PowerShell?

PowerShell has no single cmdlet that lists all five roles, so you combine Get-ADForest for the two forest roles and Get-ADDomain for the three domain roles. Both come from the ActiveDirectory module included with RSAT and installed on domain controllers.

1. Open Windows PowerShell as administrator.
2. Run Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster to view the forest-wide roles.
3. Run Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster to view the domain-wide roles.
4. For a different domain in the forest, add -Identity with that domain's name to Get-ADDomain.

These are the same property names Microsoft documents, so the output works well in scripts, monitoring checks and change records.

How Do You Transfer or Seize FSMO Roles?

You transfer a role when both domain controllers are online, and you seize it only when the current holder has failed permanently. In PowerShell both use Move-ADDirectoryServerOperationMasterRole.

1. Confirm replication is healthy and identify the DC that will receive the role.
2. To transfer, run, for example, Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster. Valid role names are PDCEmulator, RIDMaster, InfrastructureMaster, SchemaMaster and DomainNamingMaster (or the numbers 0 to 4).
3. To seize, run the same command with -Force added. According to Microsoft's cmdlet reference, it still attempts a normal transfer first and seizes only if that fails.
4. Run netdom query fsmo again to confirm the new holder.

Seizing has a consequence you must respect: Microsoft's guidance is that a DC whose Schema Master, Domain Naming Master or RID Master role was seized must not be brought back online, because two servers believing they hold the same role can corrupt the directory. Rebuild that server instead and clean up its metadata.

When you are replacing old domain controllers, our guide to installing and activating Windows Server 2022 Standard walks through the new server build before you promote it and move the roles.

Which Domain Controller Should Hold Each Role?

In a small single-domain network, leaving all five roles on one well-maintained DC is normal and works fine. Microsoft's FSMO role guidance adds a few rules for larger environments:

• Keep the forest-wide roles on a DC in the forest root domain.
• Put the PDC Emulator on a powerful, reliable DC, because of all the roles it has the biggest impact on performance.
• Avoid placing the Infrastructure Master on a global catalog server in a multi-domain forest, unless every DC in that domain is a global catalog or the AD Recycle Bin is enabled. A global catalog already holds partial copies of other domains' objects, so the Infrastructure Master on it never sees anything to update.
• Identify a standby DC for each role so you know where to move it in an emergency.

A Common Mistake We See

The issue we hear about most often happens during server upgrades: an old domain controller is switched off or wiped before its roles are transferred. Everything seems fine for days, then password changes start behaving oddly, clocks drift, or new accounts cannot be created.

Make netdom query fsmo the first and last command of any DC replacement project. Transfer roles while the old server is still healthy, demote it properly, and only then decommission it. If you are moving to newer hardware, the Windows Server collection lists the current editions, and the Windows Server 2025 Standard licence suits most single-host domain controller builds.

Frequently Asked Questions

How do I view FSMO roles quickly?

Run netdom query fsmo in an elevated Command Prompt on a domain controller. It lists the Schema Master, Domain Naming Master, PDC Emulator, RID Master and Infrastructure Master with the server holding each one. It is the fastest check before maintenance, upgrades or troubleshooting replication and authentication problems.

What is the PowerShell command to get FSMO roles?

Use Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster for the forest roles and Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster for the domain roles. Both cmdlets are in the ActiveDirectory PowerShell module, which ships with domain controllers and RSAT.

Which FSMO role is the most important?

The PDC Emulator is the role users notice first when it fails. It handles priority password replication and account lockouts, and in the forest root domain it is the time source for the forest. Kerberos authentication depends on synchronised clocks, so a missing PDC Emulator can cause sign-in failures.

Can one domain controller hold all five FSMO roles?

Yes. In a single-domain forest it is common and supported for the first domain controller to hold all five roles. The risk is concentration: if that server fails, you will need to seize roles onto another DC. Keep at least two domain controllers so a healthy server is available.

What happens if the FSMO role holder goes down?

Day-to-day sign-ins continue, because any domain controller can authenticate users. Problems appear gradually: no new domains, no schema changes, no new objects once RID pools run out, and password or time issues if the PDC Emulator is missing. Transfer roles if the outage is temporary; seize them only if the server is gone for good.

Conclusion

FSMO roles are five single-holder jobs that keep Active Directory consistent: two forest-wide and three per domain. Know where they live, check them with netdom or PowerShell, and transfer them before you retire a DC. When planning new domain controllers, browse our Windows Server 2025 licences to match the edition to your hosts.

Useful Links