How to Identify and Transfer FSMO Roles with PowerShell
Applies to: Windows Server 2019, 2022 and 2025.
Five FSMO roles coordinate forest and domain operations. Planned transfer requires healthy replication; seizure is an outage-recovery action.
Active Directory changes affect authentication across the environment. Use tested backups, separate privileged accounts and a maintenance plan. See networkmanager.info for managed Windows VPS services.
Prerequisites
- Confirm both controllers are healthy.
- Verify DNS, time and replication.
- Ensure the destination is writable.
- Never seize if the old owner may return.
Procedure
Step 1: Identify owners
Query all roles.
netdom query fsmo
Get-ADForest | Select SchemaMaster,DomainNamingMaster
Get-ADDomain | Select PDCEmulator,RIDMaster,InfrastructureMasterStep 2: Check destination
Run diagnostics.
dcdiag /s:DC02
repadmin /showrepl DC02Step 3: Transfer domain roles
Move selected roles.
Move-ADDirectoryServerOperationMasterRole -Identity 'DC02' -OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMasterStep 4: Confirm ownership
Query again and update monitoring.
Step 5: Review time hierarchy
A PDC move can affect authoritative time design.
Verification
Tools should report the new owners without replication failure.
netdom query fsmo
repadmin /replsummaryRollback and recovery
Transfer roles back normally if the original controller is healthy. Do not use seizure as rollback.
Operational notes
A seized former owner must not return without the role-specific recovery process.
Official references
Explore managed Windows Server hosting from Netcloud24 Canada.
