How can I find the current FSMO role holders in a domain/forest?

A. The five Flexible Single Master of Operation (FSMO) roles are Schema master, Domain naming master, Relative Identifier (RID) master, PDC master, and Infrastructure master. In FAQs earlier this year, I explained how to change each of these roles in the following FAQs:

How can I change the Schema master FSMO?
How can I change the Domain naming master FSMO?
How can I change the RID master FSMO?
How can I change the PDC emulator FSMO?
How can I change the Infrastructure master FSMO?

You can use a GUI to find the FSMO role holders, but you need to perform several sets of steps (for this approach, see Microsoft article Q234790.

However, you can use some other approaches to reduce the number of steps that the GUI requires to find the current FSMO role holders. First, you can use the command file dumpfsmos.cmd from the Win2K Server Resource Kit. This command uses the built-in ntdsutil.exe, which shows you all the FSMO role owners.

To find the current FSMO role holders, you simply execute the dumpfsmos command on a domain. For example, you could type the following command:

C:\&gt;dumpfsmos.cmd savilltech.com<br>

When the following information appears on the screen, find the line that reads "Server 'savilltech.com' knows about 5 roles," and read the lines below it to find information about each FSMO role holder.

Ntdsutil: roles<br>
fsmo maintenance: Connections<br>
server connections: Connect to server savilltech.com<br>
Binding to savilltech.com ... <br>
Connected to savilltech.com using credentials of locally logged on user<br>
server connections: Quit<br>
fsmo maintenance: select Operation Target<br>
select operation target: List roles for connected server<br>
Server "savilltech.com" knows about 5 roles<br><font color="#800000">Schema - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-<br>
Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
Domain - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-<br>
Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
PDC - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-Site-<br>
Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
RID - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-Site-<br>
Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
Infrastructure - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-<br>
First-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com</font><br>
select operation target: Quit<br>
fsmo maintenance: Quit<br>
Ntdsutil: Quit<br>
Disconnecting from savilltech.com ...<br><br>

You can also manually execute the ntdsutil.exe tool by performing the following steps:

1. Click Start, Run. Type cmd in the Open box, and press Enter.
2. Type ntdsutil, and press Enter.
3. Type domain management, and press Enter.
4. Type connections, and press Enter.
5. Type connect to server [server name], and press Enter.
6. Type quit, and press Enter.
7. Type select operation target, and press Enter.
8. Type list roles for connected server, and then press Enter.

Sample output from the command appears below with the text you type shown in boldface type. Below the line that reads "Server 'titanic-dc' knows about 5 roles," you'll find information about your FSMO role holders.

C:\&gt;<b>ntdsutil</b><br>
ntdsutil: <b>domain management</b><br>
domain management: <b>connections</b><br>
server connections: <b>connect to server titanic-dc</b><br>
Binding to titanic-dc ... <br>
Connected to titanic-dc using credentials of locally logged on user<br>
server connections: <b>quit</b><br>
domain management: <b>select operation target</b><br>
select operation target: <b>list roles for connected server</b><br>
Server "titanic-dc" knows about 5 roles<br><font color="#800000">Schema - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-<br>
Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
Domain - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-<br>
Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
PDC - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-Site-<br>
Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
RID - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-First-Site-<br>
Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
Infrastructure - CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-<br>
First-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com</font><br>
select operation target: <b>quit</b><br>
domain management: <b>quit</b><br>
ntdsutil: <b>quit</b><br>
Disconnecting from titanic-dc ...<br><br>

A third option for finding the current FSMO role holders is to use the dcdiag utility, which you can find in the Support/Tools folder of the Win2K Support Tools. To use the dcdiag utility, type the following command:

G:\&gt;dcdiag /test:Knowsofroleholders /v<br><br>

Sample output for the command appears below. You'll find information about your FSMO role holders below the line that reads "Starting test: KnowsOfRoleHolders."

DC Diagnosis<br><br>
Performing initial setup: <br>
* Verifing that the local machine titanic-dc, is a DC. <br>
* Connecting to directory service on server titanic-dc. <br>
* Collecting site info. <br>
* Identifying all servers. <br>
* Found 1 DC(s). Testing 1 of them. <br>
Done gathering initial info. <br><br>
Doing initial non skippeable tests<br><br>
Testing server: Default-First-Site-Name\TITANIC-DC<br>
Starting test: Connectivity<br>
* Active Directory LDAP Services Check<br>
* Active Directory RPC Services Check<br>
......................... TITANIC-DC passed test Connectivity<br><br>
Doing primary tests<br><br>
Testing server: Default-First-Site-Name\TITANIC-DC<br>
Test omitted by user request: Replications<br>
Test omitted by user request: Topology<br>
Test omitted by user request: CutoffServers<br>
Test omitted by user request: NCSecDesc<br>
Test omitted by user request: NetLogons<br>
Test omitted by user request: Advertising<br>
Starting test: KnowsOfRoleHolders<br><font color="#800000">Role Schema Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Defaul<br>
t-First-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
Role Domain Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Defaul<br>
t-First-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
Role PDC Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-F<br>
irst-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
Role Rid Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Servers,CN=Default-F<br>
irst-Site-Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com<br>
Role Infrastructure Update Owner = CN=NTDS Settings,CN=TITANIC-DC,CN=Se<br>
rvers,CN=Default-First-Site-<br>
Name,CN=Sites,CN=Configuration,DC=savilltech,DC=com</font><br>
......................... TITANIC-DC passed test KnowsOfRoleHolders<br>
Test omitted by user request: RidManager<br>
Test omitted by user request: MachineAccount<br>
Test omitted by user request: Services<br>
Test omitted by user request: OutboundSecureChannels<br>
Test omitted by user request: ObjectsReplicated<br>
Test omitted by user request: frssysvol<br>
Test omitted by user request: kccevent<br>
Test omitted by user request: systemlog<br><br>
Running enterprise tests on : savilltech.com<br>
Test omitted by user request: Intersite<br>
Test omitted by user request: FsmoCheck<br>