How to Get All Domain Controllers in Active Directory

Active Directory uses a multi-master replication model, where any domain controller (DC) can make changes, such as create users, reset passwords, etc. These changes replicate to other DCs so that if one DC is down, others can still handle most operations.

However, some operations cannot safely be performed on multiple DCs at the same time without risking conflicts. For these special tasks, AD designates a single DC as the ‘master’. These responsibilities are known as FSMO (Flexible Single Master Operations) roles.

There are five FSMO roles in total. Two of these are forest-wide roles, which can only be held by a single domain controller in the entire forest at any given time. The other three are domain-wide roles, which can only be held by one domain controller per domain at a time.

FSMO roles - Forest scope

FSMO roles - Domain scope

The PDC emulator is one of the five FSMO roles and is a domain-wide role responsible for time synchronization, password changes, and account lockouts. Because of its critical functions, it is important to know which domain controller holds this role to maintain stability and security. The PDC emulator can be identified using the following methods.

Find PDC emulator using Active Directory Users and Computers

• Open the Active Directory Users and Computers console.
• Right-click on the domain and navigate to Operations Masters.
• In the PDC tab, you can view the current PDC emulator in your Active Directory environment.

Identify PDC emulator using PowerShell

Run the following cmdlet to identify the domain controller holding the PDC emulator role in your domain.

Get-ADDomain | Select-Object PDCEmulator

Get PDC emulator via command prompt

To find the PDC emulator in your Active Directory domain using command prompt, run the following command.

netdom query fsmo | find "PDC"

While methods such as the ADUC console, NTDSUtil tool, and other approaches require administrators to perform multiple steps to view or transfer FSMO roles, PowerShell streamlines the process. With consistent cmdlets, PowerShell enables administrators to view and transfer all the five FSMO roles more quickly and efficiently.

Get all FSMO role holders using PowerShell

Use the following cmdlet to identify all domain controllers that currently hold FSMO roles within your Active Directory environment.

$domain = Get-ADDomain ; $forest = Get-ADForest
[PSCustomObject]@{
    PDCEmulator         = $domain.PDCEmulator
    RIDMaster           = $domain.RIDMaster
    InfrastructureMaster = $domain.InfrastructureMaster
    SchemaMaster        = $forest.SchemaMaster
    DomainNamingMaster  = $forest.DomainNamingMaster
}

You can also run the following command in the command prompt to view the FSMO role holders in your Active Directory environment.

netdom query fsmo

Transfer FSMO roles using PowerShell

When a domain controller is upgraded, decommissioned, or under maintenance, transfer the FSMO roles to ensure Active Directory continues to run smoothly.

Use the following cmdlet to transfer roles to another domain controller. 

Move-ADDirectoryServerOperationMasterRole -Identity "<TargetDC>" -OperationMasterRole "<Role>"

Replace <TargetDC> with the target DC’s host name and <Role> with one or more of the following roles: SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, or InfrastructureMaster.

FSMO roles and the global catalog are two distinct components of Active Directory, each serving a unique function in managing and accessing directory data. Here's a breakdown of the key differences between FSMO roles and the global catalog (GC) in Active Directory.

Enabling the global catalog (GC) on a domain controller improves search performance, user logins, and access to resources across domains. This is because a global catalog (GC) has a partial read only replica of all objects in the directory.

While enabling global catalog may not seem necessary when promoting a new server, it becomes important as the environment grows or for cross-domain queries and authentication. Here are the methods to set up a global catalog on a domain controller in Active Directory.

Enable global catalog on a domain controller using ADSS 

• Open the Active Directory Sites and Services console and expand the sites.
  
• Right-click NTDS Settings under the Servers object and select Properties.
• Under the General tab, check the box beside Global Catalog and click OK.

Promote domain controller to global catalog using PowerShell

Run the following cmdlet to enable the GC on a domain controller. Replace <DCName> with the actual name of the DC.

Set-ADObject -Identity (Get-ADDomainController -Identity "<DCName>").ntdsSettings -Replace @{options='1'}

A domain controller failure in an Active Directory environment can cause major disruptions. Users may encounter authentication errors, while services such as DNS, DHCP, or VPN may stop working if they depend on the failed DC. The overall impact depends on whether other DCs are available to take over its roles.

Effects of a domain controller failure in Active Directory

The following scenarios illustrate the impact of different domain controller failures in Active Directory.

Best practices for maintaining domain controllers in Active Directory