And this lesson will talk about managing faith morals.
There are five flexible single master operations roles in Windows domain.
Each role plays an important part in the ongoing maintains of the domain and each resides on only a
single domain controller.
When a new forest and domain are created all the fees Morales relied on a single domain controller the
first domain controller in the forest the five roles are schema master the schema master is a forest.
Why do role are responsible for all updates to the ADT a schema the schema master is the only domain
controller that can write to the directories schema by default.
Only members of the schema Edmunds group have the right to transfer or seize the schema master role.
The second rule is domain name and master the domain name and master is the forest wide role responsible
for both the addition and removal of domains and directory partitions.
By default only members of the enterprise admins group have the right to transfer or seize the domain
name and master or all the surface morale of LEP flexible single master operations role is our right.
Master there already master is a domain wide a role responsible for allocating blocks of relative identifiers
or our ideas to each domain controller in the domain.
When a domain controller creates and use security principles such as group user or computer object the
object is assigned and you globally unique security identifier or cede this suit is a combination of
the domain said plus and our idea assigned to the object by the already master by default.
Only members of domain Edmonds the group have the right to transfer seize the already master role PDC
emulator the PDC emulator is a definite source of password information and the PDC emulator in the forest
through domain in the windows time service source for the entire forest the PDC emulator role is an
domain wide role by default only members of domain Edmund's group have the right to transfer or seize
the PDC emulator role and the last role for his morale is infrastructure master the infrastructure master
is the domain wide role responsible for updating references to objects in other domains and for replicating
those changes to other domain controllers in domain.
And now fast recap of fears Morales once again schema master is a forest white roll domain name and
master is a forest wide roll already master is the domain wide roll PDC emulator is also a domain wide
role and infrastructure master is domain wide role as well.
Now let's move on to transfer in fears Morales when a new forest is created all five feeds Morales reside
on the first domain controller in a small domain that's perfectly accessible but it's not appropriate
for a large enterprise distributing their fees morals across multiple domain controllers provides a
more balanced allocation of resources typically the PDC emulator and the already master roles for each
domain reside on a single domain controller and the two forest wide roles schema master and domain name
and master reside on a single domain controller you can transfer their fears Morales from one domain
controller to another by using the move Ada directories server operation master role command let one
big advantage to use in Windows power shall for this operation is that you can move more than one role
at a time so for example if you wanted to move the three domain wide roles from their current location
to lab DC 2 for example you might start by looking to find out where they currently reside if you didn't
know that the roles are on lab DC one was that we get AIDS.
The main command left.
Which also gives you quite a bit of other information about the domain.
Let's run this command lad get the shady domain with identity parameter for Qantas or dot com and it
reveals lots of information regarding Qantas or dot com domain.
Now to move the three domain wide rules we can use the following command.
Move dash ADR directories thorough preparation master Royal Command led with Operation master parameter
and identity parameter for Operation master parameter will use the following PDC emulator read Master
and infrastructure master and we'll do that for control so dot com domain after a prompt to confirm
that we really want to move the roles it's down again let's use get a D domain controller to view the
result to find out where the forest white Rolls are used they get a DeForest command let this show that
both the schema master and domain name in master roles currently reside on lap DC 1 to move them to
lap DC 3 for example we can use the following move a d directories sorrow reparation must to roll again
identity lab this is 3 and Operation master role will be schema master around the main name in Master
again to make sure that the roles have transferred successfully use either get a forest command let
or get aided the main com controller command led of course the preferred method to move roles between
the main controller that is to politely transfer them as we've described before but sometimes that's
simply not possible the cause could be some something planned like a domain immigration or something
unplanned like a major disaster recovery scenario as long as there is still one domain controller in
the domain you can seize the roles to that domain controller you should not do this if there is any
chance that the original domain controller host the role your season might ever come back online so
it's important to remember that after office morale has been seized from a domain controller that domain
controller should not ever be allowed to connect to the domain ever so if your office morale hold isn't
currently available but you expect it to be restored and available soon you should to wait for it or
seize the roles and the decommission the server seizing their operations master roles uses the same
command as transfer in the roles except that season uses the force parameter even when you use the force
parameter however aided yes attempts to transfer the role if it can reach the current holder of the
role only if that fails will HDD allow you to seize the role to seize the domain wide rolls back to
a lab DC one to use the following command move Ada direct through server operation Master roll operation
master PTC emulator read Master infrastructure master identity lab the C1 and forest parameter again
you are prompted to confirm which seizure and then the roles are seized the process takes somewhat longer
because an attempt is made to contact the current role Holder third term to transfer operation first
I want to see the role now because I need this domain controller in the future but if I have seized
the role from left this it too I'd have to remove that lab GC to server from my environment.