Recently I found myself having to recover an Active Directory domain that had lost its Primary Domain Controller (which held all the FSMO roles).
Fortunately the domain had a second Domain Controller, so it was possible to forcibly move the FSMO roles to the working DC.
While I was carrying out the procedure I wasn’t able to take screenshots of the various steps, but I took them from a blog post that I followed as a guide.
First of all, make sure you run these tasks with an account that has Domain Admins and Schema Admins permissions.
Connect to one of the Domain Controllers that are still working and check the state of the domain with the command:
dsquery server -forest
Check which domain controllers own the FSMO roles:
netdom query fsmo
To transfer the roles to other domain controllers you need to register a specific DLL, using the command:
regsvr32 schmmgmt.dll
Now you can transfer the roles of the failed Domain Controller using the ntdsutil tool.
Ntdsutil
roles
connections
connect to server DC2
q
Then you can force the move of the 5 FSMO roles using the following commands:
seize naming master
seize infrastructure master
seize rid master
seize schema master
seize pdc
q
Each operation asks for confirmation before the role transfer starts.
Once all 5 roles have been moved, you need to remove the references to the old, failed Domain Controller:
metadata cleanup
connections connect to server DC2
q
List the Active Directory sites:
select operation target
list sites
Select the site where the failed DC is located:
select site 0
list servers in site
Select the failed Domain Controller and display the list of domains:
select server 0
list domains
Select the domain and go back to the metadata cleanup menu:
select domain 0
q
Now remove the failed Domain Controller:
remove selected server
Now we need to clean up AD from the remaining entries related to the deleted Domain Controller.
Open the snap-in from Administrative Tools -> Active Directory Sites and Services . Expand the site where the deleted Domain Controller is located, select it and choose Delete . Confirm the removal twice.
Then open the DNS snap-in and remove the PTR and A records for the Domain Controller you just deleted.
Also remove the Domain Controller object from the Active Directory Users and Computers console:
This way we have forcibly moved the FSMO roles off the failed Domain Controller and completely removed every trace of its existence from DNS and Active Directory. The remaining Domain Controller has become the primary domain controller (and the owner of all the FSMO roles).