FSMO role holder details should be retrievable
AD-DC-06InfoActive DirectoryDomain controllers
Part of Active Directory · Active Directory · Domain controllers · All checks
Invoke-Maester -TestId AD-DC-06Overview
Section titled “Overview”Understanding FSMO (Flexible Single Master Operations) role distribution is critical for:
- Operational awareness: Knowing which DCs perform critical directory operations
- Disaster recovery: Being able to quickly seize roles if a DC fails
- Maintenance planning: Understanding impact of DC downtime
- Security monitoring: Tracking changes to FSMO role holders
The 5 FSMO roles are:
- Schema Master (forest-wide): Controls Active Directory schema updates
- Domain Naming Master (forest-wide): Controls domain additions and removals
- PDC Emulator (domain-wide): Primary DC for backward compatibility and time sync
- RID Master (domain-wide): Allocates relative IDs for security identifiers
- Infrastructure Master (domain-wide): Handles cross-domain object references
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Document your FSMO role holders and keep the documentation updated
- Ensure FSMO role holders are highly available DCs
- Place at least one role holder in a different site for geographic redundancy
- Monitor for unexpected FSMO role transfers
- Test FSMO role seizure procedures periodically
How the Test Works
Section titled “How the Test Works”This test retrieves the current FSMO role holders from the domain and forest objects, then displays:
- Which DC holds each FSMO role
- How many roles each DC holds
- Total number of unique FSMO role holders
Related Tests
Section titled “Related Tests”Test-MtAdDcAllFsmoRolesCount- Identifies DCs holding all 5 rolesTest-MtAdDomainControllerCount- Total DC count
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DC-06 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain controllers |
| Area | Infrastructure hardening |
| Resource type | DomainController |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDcFsmoRoleHolderDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS:ReadProperty, ActiveDirectory:Ldap:nTDSDSA:ReadProperty, ActiveDirectory:Ldap:crossRef:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain-controller/Test.AD-DC-06.ps1 - Documentation:
tests/ad/domain-controller/Test.AD-DC-06.md