DCs with all FSMO roles count should be retrievable
AD-DC-05InfoActive DirectoryDomain controllers
Part of Active Directory · Active Directory · Domain controllers · All checks
Invoke-Maester -TestId AD-DC-05Overview
Section titled “Overview”FSMO (Flexible Single Master Operations) roles are critical directory services operations that can only be performed by one domain controller at a time:
- Schema Master: Controls schema updates
- Domain Naming Master: Controls domain additions/removals
- PDC Emulator: Primary DC for backward compatibility
- RID Master: Allocates relative IDs for SIDs
- Infrastructure Master: Handles cross-domain object references
Concentrating all 5 FSMO roles on a single DC creates a single point of failure. While not a direct security issue, it impacts:
- Availability: If the FSMO role holder fails, certain operations cannot be performed
- Disaster recovery: All critical roles are in one location
- Maintenance: Updates to the FSMO holder require careful planning
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Consider distributing FSMO roles across multiple domain controllers for redundancy:
- Place Schema Master and Domain Naming Master in the forest root domain
- Place PDC Emulator, RID Master, and Infrastructure Master in each domain
- Ensure at least one FSMO role holder is in a different physical location
- Document FSMO role locations and transfer procedures
How the Test Works
Section titled “How the Test Works”This test identifies which domain controllers hold FSMO roles and counts how many DCs hold all 5 roles. It displays:
- Current FSMO role holders
- Number of unique DCs holding roles
- Whether any single DC holds all roles
Related Tests
Section titled “Related Tests”Test-MtAdDcFsmoRoleHolderDetails- Detailed FSMO role distributionTest-MtAdDomainControllerCount- Total DC count
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DC-05 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain controllers |
| Area | Infrastructure hardening |
| Resource type | DomainController |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDcAllFsmoRolesCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:crossRef:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain-controller/Test.AD-DC-05.ps1 - Documentation:
tests/ad/domain-controller/Test.AD-DC-05.md