Skip to main content

How to get the FSMO roles in PowerShell

By

Even though our domains are multimaster domains, not all functionality can be handled by each machine independently. For example, let’s take a look at the RID Master role.

And RID is what uniquely identifies all security objects in a domain. A security object is either a user, computer, group, or INetOrgPerson. Each of these objects have a Security Identifier (SID). A SID looks like this:

S-1-5-21-576790344-2948317706-4057815606-1702

To break this down:

S

The string is a SID

1

The revision level

5

The identifier value. Possible identifier authority values are:

0 – Null Authority

1 – World Authority

2 – Local Authority

3 – Creator Authority

4 – Non-unique Authority

5 – NT Authority

9 – Resource Manager Authroity

576790344-2948317706-4057815606

Domain or local computer identifier

Relative Identifier (RID). This is unque in the domain.

1702

   

Active Directory uses the SID to identify an object that can have security access assigned to it. You and I use the user name. the username name maps to a SID with the RID portion being unique in the domain. If two domain controller are handing our RIDs to new objects, there is a chance that two objects could get the same SID. This would allow the two different users to have the same access as the other one. With the RID Master being a single domain controller, this cannot happen.

The easiest way to discover the FSMO (Flexible Single Master Operation) roles was to use NETDOM Query FSMO.

clip_image001

If you need to discover these roles in a PowerShell script, this would be difficult as the information is returned as a string of text. To execute the below PowerShell commands, you must do this on a client or server with the ActiveDirectory module installed.

Import-Module ActiveDirectory

$FSMOObj = New-Object PSObject
# Retrieve the Schema Master
$FSMOObj | Add-Member -MemberType NoteProperty -Name "Schema" -Value (Get-ADForest).SchemaMaster
# Retrieve the Domain Naming
$FSMOObj | Add-Member -MemberType NoteProperty -Name "DomainNaming" -Value(Get-ADForest).DomainNamingMaster
# Retrieve the PDC
$FSMOObj | Add-Member -MemberType NoteProperty -Name "PDC" -Value(Get-ADDomain).PDCEmulator
# Retrieve the Infrastructure Master
$FSMOObj | Add-Member -MemberType NoteProperty -Name "Infrasturcture" -Value(Get-ADDomain).InfrastructureMaster
# Retrieve the RID pool manager
$FSMOObj | Add-Member -MemberType NoteProperty -Name "RID" -Value(Get-ADDomain).RIDMaster

#Send the object to the Pipeline.
Write-Output $FSMOObj

This will send objects into the PowerShell pipeline that you can use in your code.

Labels:

Comments

Post a Comment

Popular posts from this blog

Adding a Comment to a GPO with PowerShell

By
As I'm writing this article, I'm also writing a customization for a PowerShell course I'm teaching next week in Phoenix.  This customization deals with Group Policy and PowerShell.  For those of you who attend my classes may already know this, but I sit their and try to ask the questions to myself that others may ask as I present the material.  I finished up my customization a few hours ago and then I realized that I did not add in how to put a comment on a GPO.  This is a feature that many Group Policy Administrators may not be aware of. This past summer I attended a presentation at TechEd on Group Policy.  One organization in the crowd had over 5,000 Group Policies.  In an environment like that, the comment section can be priceless.  I always like to write in the comment section why I created the policy so I know its purpose next week after I've completed 50 other tasks and can't remember what I did 5 minutes ago. In the Group Policy module for PowerShell V3, th
Post a Comment
Read more

Return duplicate values from a collection with PowerShell

By
If you have a collection of objects and you want to remove any duplicate items, it is fairly simple. # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   # Remove the duplicate values. $Set1 | Select-Object -Unique 1 2 3 4 5 6 7 What if you want only the duplicate values and nothing else? # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   #Create a second collection with duplicate values removed. $Set2 = $Set1 | Select-Object -Unique   # Return only the duplicate values. ( Compare-Object -ReferenceObject $Set2 -DifferenceObject $Set1 ) . InputObject | Select-Object – Unique 1 2 This works with objects as well as numbers.  The first command creates a collection with 2 duplicates of both 1 and 2.   The second command creates another collection with the duplicates filtered out.  The Compare-Object cmdlet will first find items that are diffe
Post a Comment
Read more

How to list all the AD LDS instances on a server

By
AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.
Post a Comment
Read more