Why after I seize a FSMO role I can’t transfer it back to its original DC

active-directorydomain-controllerwindows-server-2008

Everywhere I read about the FSMO roles it is written that after it is seized the FSMO role can not be transferred back to its original server.

Did someone knows why? Lets say that I seize the Schema Master and then I try to transfer it back? What will happen?

Of course that this does not apply to PDC Emulator or the Infrastructure master.

Best Answer

With the PDC Emulator and Infrastructure roles, this doesn't apply; they're able to recover just fine from a seizure, and can be transferred and seized all over the place to your heart's content.

With the rest (RID, Naming, and Schema), it's not that you can't transfer back. It's that the recommendation is to never turn a DC back on after the role has been seized from it. The risk is that the two DCs both think they own the role; divergent schema changes, overlapping RIDs, and overlapping domains in the forest are the potential results.

How difficult it is to create these scenarios is another matter entirely (knowledge of the seizure will replicate to the old role holder and it will cease thinking it's the master - broken replication/connectivity is needed to create any risk); the recommendation to not bring the old DC back online is made due to an abundance of caution on Microsoft's part.

If you have to seize a RID, Naming, or Schema master's role, the safe course is to nuke the DC's metadata from orbit and reinstall the OS.

Related Topic