Rebeladmin Corp. is a managed IT service provider. They have introduced a new client management system where clients can open service tickets, check their billings, track the project progress, and so on. Every customer and every employee gets an account in it. Each of these user accounts gets certain privileges based on their roles and responsibilities. Support engineers are allowed to open tickets, edit tickets, and close tickets. But they are not allowed to change the schedules, delete tickets, change the appearance of the portal, or change the system database settings. Only operation manager Sean can do similar system level changes. What if everyone is allowed to do these kinds of system-level changes? Will the system be able to maintain its integrity for long? Keeping system-level change permissions limited to certain roles will prevent unnecessary structural changes and data modifications.

Active Directory infrastructures are built upon multi-master databases. This means that any writable domain controller in the domain can update the database values. But there are some operations that need to be controlled in a sensible manner in order to maintain the integrity of AD DS. These operations are better managed in a single-master mode rather than a multi-master mode. These special roles are called Flexible Single Master Operation (FSMO) roles. These roles can run from one domain controller or be distributed among multiple domain controllers (according to guidelines). But each role can appear only once in a domain or forest. It makes the operation master holder important in an AD DS infrastructure and in the event of its failure, it will prevent changes. In such a catastrophe, if the operation master holder cannot recover, another domain controller will have to forcefully regain control over its operation master roles.

In this chapter, we are going to look into the following topics:

• FSMO roles and duties
• FSMO role placement
• Moving FSMO roles
• Seize FSMO roles