Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.
FSMO role movement is required during domain-controller lifecycle work, maintenance, or disaster recovery.
Prerequisites
- Administrative access to the affected Windows Server hosts.
- A tested backup or documented rollback point.
- An approved maintenance window for production systems.
Step-by-step configuration
- Identify all current role holders and verify replication health.
- Use a normal transfer when the source server is online.
- Move roles to a healthy writable domain controller with current backups.
- Use seizure only when the former owner is permanently unavailable.
- Validate DNS, time service, and replication after the move.
PowerShell and command-line procedure
netdom query fsmo
Move-ADDirectoryServerOperationMasterRole -Identity "DC02" -OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMaster
netdom query fsmo
repadmin /replsummary
Verification
All five roles report the intended owner and dcdiag plus repadmin complete without critical errors.
Rollback
Transfer roles back only after the original domain controller is healthy and replication is verified. Never reconnect an old role holder after seizure without proper metadata recovery.
Security and operational guidance
- Apply least privilege and document every production change.
- Test the procedure in an isolated environment before broad deployment.
- Replace all example names, paths, and TEST-NET addresses with approved production values.
- Monitor relevant Windows event logs after the change.
Related resources
Deploy or manage Canadian Windows VPS infrastructure with networkmanager.info. Validate production decisions against the official Microsoft Windows Server documentation.
