AD-DC-05 - DCs with all FSMO roles count should be retrievable
Overview
FSMO (Flexible Single Master Operations) roles are critical directory services operations that can only be performed by one domain controller at a time:
- Schema Master: Controls schema updates
- Domain Naming Master: Controls domain additions/removals
- PDC Emulator: Primary DC for backward compatibility
- RID Master: Allocates relative IDs for SIDs
- Infrastructure Master: Handles cross-domain object references
Concentrating all 5 FSMO roles on a single DC creates a single point of failure. While not a direct security issue, it impacts:
- Availability: If the FSMO role holder fails, certain operations cannot be performed
- Disaster recovery: All critical roles are in one location
- Maintenance: Updates to the FSMO holder require careful planning
Security Recommendation
Consider distributing FSMO roles across multiple domain controllers for redundancy:
- Place Schema Master and Domain Naming Master in the forest root domain
- Place PDC Emulator, RID Master, and Infrastructure Master in each domain
- Ensure at least one FSMO role holder is in a different physical location
- Document FSMO role locations and transfer procedures
How the Test Works
This test identifies which domain controllers hold FSMO roles and counts how many DCs hold all 5 roles. It displays:
- Current FSMO role holders
- Number of unique DCs holding roles
- Whether any single DC holds all roles
Related Tests
Test-MtAdDcFsmoRoleHolderDetails- Detailed FSMO role distributionTest-MtAdDomainControllerCount- Total DC count
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-DC-05 |
| Severity | Info |
| Suite | Active Directory |
| Category | AD.DomainController |
| PowerShell test | Test-MtAdDcAllFsmoRolesCount |
| Tags | AD, AD-DC-05, AD.DomainController |
Source
- Pester test:
tests/ad/domaincontroller/Test-MtAdDcAllFsmoRolesCount.Tests.ps1 - PowerShell source:
powershell/public/ad/domaincontroller/Test-MtAdDcAllFsmoRolesCount.ps1