Seizing FSMO roles from a dead Domain Controller

Indicators

• Schema changes failing (Schema Master held by dead DC)
• Cannot create users in some OUs (RID Master / PDC Emulator issues)
• GPO changes not propagating, time skew (PDC Emulator down)
• New domain join failures in a multi-domain forest (Infrastructure / Domain Naming)

Likely causes

• FSMO holder has hardware-failed and cannot be recovered in time
• FSMO holder is corrupt and metadata cleanup is required
• FSMO holder was decommissioned without graceful role transfer

Diagnostic steps

1. Identify current FSMO holders: netdom query fsmo, or Get-ADDomain / Get-ADForest
2. Confirm the holder is genuinely unrecoverable — graceful Move-ADDirectoryServerOperationMasterRole (transfer) is always preferred over Seize
3. Decide seize order — PDC Emulator and RID Master are the most time-critical for a single-domain SMB
4. Seize via ntdsutil → roles → connections → connect to server <healthy-DC> → seize <role>; or Move-ADDirectoryServerOperationMasterRole -Force
5. Immediately follow with metadata cleanup of the dead DC — remove NTDS settings, computer object, DNS records
6. Verify with netdom query fsmo and dcdiag /test:advertising

Resolution path

• Confirm dead DC is dead AND will never return
• Seize roles via ntdsutil or PowerShell
• Clean metadata, DNS, site link references
• Validate domain operations end-to-end
• Stand up replacement DC and rebalance roles

Prevention

• Document FSMO placement in the DR runbook
• Place PDC Emulator and RID Master on most reliable DC
• Two DCs minimum so a healthy seize target always exists
• Annual FSMO transfer drill

Tools

• ntdsutil
• Move-ADDirectoryServerOperationMasterRole (PowerShell)
• netdom query fsmo
• DNS Manager (clean up SRV records of seized DC)
• Sites and Services (NTDS settings cleanup)

References

• Microsoft Learn — FSMO role placement and recovery
• Microsoft Learn — Move or seize FSMO roles to a domain controller
• Engineer Direct guide — Seize FSMO from dead domain controller