How to Transfer FSMO Roles in Active Directory Using PowerShell

The Challenge of Migrating Domain Controllers

When it is time to upgrade your network from an old Windows Server 2016 Domain Controller to a brand new Windows Server 2022 machine, you cannot simply turn off the old server. Active Directory relies on five critical Flexible Single Master Operations (FSMO) roles to function correctly:

• Schema Master (Forest-wide)
• Domain Naming Master (Forest-wide)
• PDC Emulator (Domain-wide)
• RID Master (Domain-wide)
• Infrastructure Master (Domain-wide)

If you decommission the server holding these roles without transferring them first, you will permanently corrupt your Active Directory forest. Historically, transferring these roles using the graphical user interface (GUI) was a tedious nightmare requiring you to open three completely separate Microsoft Management Consoles (MMCs)—one of which required manually registering a hidden .dll file. Today, you can transfer all five roles in seconds using a single PowerShell command.

Step 1: Identify the Current Role Holder

Before making any changes, you should confirm which server currently holds the FSMO roles. Open the Command Prompt or PowerShell on any domain-joined computer and execute:

netdom query fsmo

This command will output a list of all five roles alongside the hostname of the server that currently owns them (for example, OLD-DC01.yourdomain.local).

Step 2: Use PowerShell to Transfer the Roles

Log into the new Domain Controller (the server you want to receive the roles) using an account that belongs to the Enterprise Admins and Schema Admins groups. Open Windows PowerShell as an Administrator.

The cmdlet used for this task is Move-ADDirectoryServerOperationMasterRole. To make the command shorter, you can specify the roles using their numerical IDs (0 through 4) instead of typing out their full names.

Run the following command, replacing NEW-DC02 with the actual hostname of your new destination server:

Move-ADDirectoryServerOperationMasterRole -Identity "NEW-DC02" -OperationMasterRole 0,1,2,3,4

Step 3: Confirm the Transfer

As soon as you press Enter, PowerShell will prompt you to confirm the transfer of each role individually. Type Y (or A for Yes to All) and press Enter.

The transfer process typically takes less than ten seconds. Once the prompt returns, the roles have been successfully moved to the new server.

Step 4: Verify Success

To guarantee that the Active Directory database has successfully registered the change, run the query command one more time:

netdom query fsmo

You should now see the hostname of your new Domain Controller listed next to all five FSMO roles. You are now safe to proceed with demoting and decommissioning your old server.