Lesson 5: Configuring

Domain Controllers
 Overview
• Configure Domain Controllers
• Understanding Domain Controllers
• Installing and Configuring an RODC

2
Understanding Domain
Controllers
Lesson 5: Configuring Domain Controllers

3
 Active Directory
Logical Components

Organization
Domains
Units

Domain
Forests
Trees

4
 Active Directory
Physical Components
Global
Domain
Catalog
Controllers
Servers

Read-Only
Operations
Domain
Masters
Controllers

5
 Domain Controllers
• A domain controller is a Windows server that
stores a replica of the account and security
information for the domain and defines the
domain boundaries.
• To make a computer running Windows
Server a domain controller, you must install
the AD DS and promote to a DC.
• Each domain has its own set of domain
controllers.

6
 Global Catalogs
• As a domain controller, a global catalog
stores a “copy” of all objects in the domain.
• A global catalog is created automatically
on the first domain controller in the forest.
• Optionally, other domain controllers can be
configured to serve as global catalogs.
o GC only runs on DCs

7
 Global Catalogs and
Universal Groups
• One of the primary functions of a global catalog is
to provide search capability of any object in the
forest.
• Another function of global catalog is to resolve User
Principal Names (UPNs).
• Membership of universal groups is stored only in the
global catalog and is replicated across the forest.
• When a user logs on, the domain controller must be
able to view the membership of the universal
groups, so that it can be determined whether a user
is allowed or denied logon based on the
membership of the universal group.

8
 Multi-Master Model
• Active Directory is based on a Multi-Master
Model for most activity
• A multi-master enabled database, such as
the Active Directory, provides the flexibility
of allowing changes to occur at any DC in
the enterprise.
• It's done by resolving to the DC to which
changes were written last, which is the last
writer wins.

9
 Single-Master Roles
• To prevent conflicting updates in Windows, the Active
Directory performs updates to certain objects in a single-
master fashion.
• In a single-master model, only one DC in the entire
directory is allowed to process updates.
• Active Directory extends the single-master model found
in earlier versions of Windows to include multiple roles,
and the ability to transfer roles to any DC in the
enterprise.
• Because an Active Directory role isn't bound to a single
DC, it's referred to as an FSMO role. Currently in Windows
there are five FSMO roles (next slide)

10
Operations Master Roles
Primary Domain Controller (PDC) Emulator

Infrastructure Master

Relative Identifier (RID) Master

Schema Master

Domain Naming Master

11
 Schema Master
• The schema master FSMO role holder is the DC
responsible for performing updates to the
directory schema.
o These are the objects and attributes that can be
created in AD
• Once the Schema update is complete, it's
replicated from the schema master to all other
DCs in the directory.
• Changes to the schema can only be dome by
members of the Schema Admins group
• There's only one schema master per forest.
12
 Domain Naming Master
• The domain naming master FSMO role
holder is the DC responsible for making
changes to the forest-wide domain name
space of the directory.
o Domains are added or removed in the
forest.
• There's only one domain naming master per
forest.

13
 RID Master
• The RID master FSMO role holder is the single DC responsible
for processing RID Pool requests from all DCs within a given
domain.
• When a DC creates a security principal object, such as a user
or group, it attaches a unique Security ID (SID) to the object.
This SID consists of:
o A domain SID that's the same for all SIDs created in a
domain.
o A relative ID (RID) that's unique for each security principal
SID created in a domain.
• Each Windows DC in a domain is allocated a pool of RIDs that
it's allowed to assign to the security principals it creates.
• There's one RID master per domain.

14
 PDC Emulator
• The PDC emulator is necessary to synchronize time in an
enterprise.
• All Windows-based computers within an enterprise use a
common time.
• In a Windows domain, the PDC emulator role holder retains the
following functions:
o Password changes done by other DCs in the domain are
replicated preferentially to the PDC emulator.
o When authentication failures occur at a given DC because of
an incorrect password, the failures are forwarded to the PDC
emulator before a bad password failure message is reported
to the user.
o Account lockout is processed on the PDC emulator.
• There's one PDC Emulator master per domain.

15
 Infrastructure Emulator
• When an object in one domain is referenced by
another object in another domain, like when a user
in one domain gets added to a group in another
domain
• The infrastructure FSMO role holder is the DC
responsible for updating an object's SID and
distinguished name in a cross-domain object
reference.
• There's one Infrastructure master per domain.

16
 Viewing the Operations
Masters Role Holders
• The easiest way to view the holders of all
Operations Masters at once:
netdom query fsmo
• To view the RID Masters, PDC Emulators, or
Infrastructure Master, use the Active
Directory Users and Computers console.

17
 Viewing Operations Masters

Viewing the holders of the Operations Masters roles at

the command prompt

18
 Viewing the Operations
Masters Role Holders
• To view the holder of the Domain Naming
Master role, use the Active Directory
Domains and Trusts console.
• To view the holder of the Schema Master
role, use the Active Directory Schema.

19
View the Holders of RID Master, PDC
Emulator, or Infrastructure Master

Selecting Operations Masters

20
View the Holders of RID Master, PDC
Emulator, or Infrastructure Master

Using the Active Directory Users and Computers console to view

the holders of the domain-based Operation Masters roles

21
View the Domain Naming Operations
Master Role Holder

Using the Active Directory Domains and Trusts console

to view the holders of the Domain Naming
Operations Master
22
View the Schema Master Operations
Master Role Holder

Opening the Add or Remove Snap-in dialog box

23
 Transferring the
Operations Masters Role
• Common reasons to transfer the Operations
Master:
o Planned maintenance
o Retiring a domain controller that holds a role of
Operations Master
o Moving a role of Operations Master to a domain
controller with more resources
• Transferring a FSMO role requires that the
source domain controller and the target
domain controller be online.

24
 Seizing the Operations
Masters Role
• If a domain controller that holds an
Operations Master role has an
unrecoverable failure, you cannot transfer
roles because the current domain controller
is not online. Therefore, you need to seize
the role.
• Seizing a FSMO role is a drastic measure that
should be performed only in the event of a
permanent role holder failure.
• To seize a role of an Operations Master, you
use the [Link] utility.
25
Seize the Role of an Operations
Master Holder

Seizing the PDC Emulator role

26
Installing and Configuring
an RODC
Lesson 5: Configuring Domain Controllers

27
 Read-Only Domain
Controller (RODC)
The Read-Only Domain Controller (RODC):
• Contains a full replication of the domain
database.
• Was created to be used in places where a
domain controller is needed but the
physical security of the domain controller
could not be guaranteed.

28
 Installing an RODC
• You must have a writable domain control
installed prior to installing an RODC
• Not all passwords are replicated to an RODC
• You can configure each RODC to have its own
Password Replication Policy (PRP).
• To allow enterprise-wide configuration of the
RODC PRP, Windows Server 2008 creates the
following security groups:
o Denied RODC Password Replication Group
o Allowed RODC Password Replication Group

29
Install a Read-Only
Domain Controller

Selecting an RODC

30
 Install a Read-Only
Domain Controller

Specifying the delegated administrator

31
 Install a Read-Only
Domain Controller

Configuring the Password Replication Policy

32
 YouTube Videos
Windows Server 2022 Transferring FMSO Roles from one Domain
Controller to another

6- Windows Server 2022 Transferring FMSO Roles from one Domain

Controller to another – YouTube

How to setup a Read-Only Domain Controller (RODC)

How to setup a Read-Only Domain Controller (RODC) – YouTube

33