Migrate File Server from Server 2003 to 2008R2 or 2012 with Robocopy(with ntfs permissions)

Option 1

:-   You can either use the Microsoft FSMT tool, or you can use Robocopy (more powerful).All robocopy operations are incremental in nature. Which means that only new files/folders, or files that have changed will be copied. Obviously when you perform a robocopy operation for the first time, all folders and files are new on the destination server.

Initial copy of data

Lets assume the 2003 file server’s name is 2003FS, while the 2008 R2 file server’s name is 2008R2FS. And we are going to move two folders, named Finance and General, on the D-drive of the old server to the D-Drive of the new server. Then the syntax for copying data would be as following (the command will obviously be ran at the destination server)

robocopy \\2003FS\d$\Finance D:\Finance /e /zb /copy:DATSOU /r:3 /w:3 /log:c:\robocopylog\finance.log /V /NP

robocopy \\2003FS\d$\General D:\General /e /zb /copy:DATSOU /r:3 /w:3 /log:c:\robocopylog\General.log /V /NP

The switches are explained as such:

/E :: copy subdirectories, including Empty ones.
/ZB :: use restartable mode; if access denied use Backup mode.
/COPY:copyflag[s] :: what to COPY for files (default is /COPY:DAT).
(copyflags : D=Data, A=Attributes, T=Timestamps).
(S=Security=NTFS ACLs, O=Owner info, U=aUditing info).

/R:n :: number of Retries on failed copies: default 1 million.
/W:n :: Wait time between retries: default is 30 seconds.

/LOG:file :: output status to LOG file (overwrite existing log).
/V :: produce Verbose output, showing skipped files.
/NP :: No Progress – don’t display percentage copied.

Copy data for the final time

 robocopy \\2003FS\d$\Finance D:\Finance /e /zb /copy:DATSOU /mir /r:3 /w:3 /log:c:\robocopylog\FinalMirror\Finance.log /v /NP

 robocopy \\2003FS\d$\General D:\General /e /zb /copy:DATSOU /mir /r:3 /w:3 /log:c:\robocopylog\FinalMirror\Finance.log /v /NP

 have included the /mir switch here

/MIR :: MIRror a directory tree (equivalent to /E plus /PURGE).

In other words, /mir will do the same as /e and /purge

/PURGE :: delete dest files/dirs that no longer exist in source.

Keep in mind, it will only delete files/dirs at the destination, NOT at the source. Some people believe, for some strange reason, that files at the source are deleted as well. That is NOT the case.

Synchronizing NTFS permissions and other file related properties only

If you forget to include the /copy:DATSOU or /copyall option for whatever reason, and now are looking for a switch on how to synchronize the NTFS permissions, or other file related properties, then you can use the /secfix option

/SECFIX :: FIX file SECurity on all files, even skipped files.

When using the /SECFIX copy option, specify the type of security information you want to copy by also using one of these additional copy options: /COPYALL /COPY:O /COPY:S /COPY:U /SEC

The following example synchronizes file security information for the Finance folder we copied from the 2003FS server earlier

robocopy \\2003FS\D$\Finance D:\Finance /secfix /copy:SOU /r:3 /w:3 /log:c:\robocopylog\SecFix\Finance.log /V /NP

 Remember this will only synchronize file security information between the source and the destination, it will not copy any files. To completely synchronize data and file security information, use the following command

robocopy \\2003FS\D$\Finance D:\Finance /e /zb /secfix /copy:DATSOU /mir /r:3 /w:3 /log:c:\robocopylog\FinalMirror\Finance.log /v /NP

The /MT option

[:n] :: Do multi-threaded copies with n threads (default 8). n must be at least 1 and not greater than 128.
This option is incompatible with the /IPG and /EFSRAW options

Simply put, it will make the copy operation go faster, but use it with caution, if you define too many threads, you will saturate the network card of your server, or saturate the bandwidth of your network. Personally I rarely use this switch.

Caveat to copying in two phases

There is a small caveat to copying data in two phases. If someone changes only security information of a file/folder between phase 1 and phase 2, but not the content, that file/folder will be skipped during the copy process in phase 2, therefore the new NTFS permissions on the file will not be copied either.

The chances for someone to change only NTFS permissions on a file/folder between phase 1 and phase 2 might not be big, but they are certainly there. So if you know that might happen, you can use the /secfix option at phase 2 to copy NTFS permissions on files/folders, regardless of whether the file/folder has already been copied in phase 1 or not. The command you would use, is the final command in step 4 of this post.

how to retain share names and permissions.

Basically you need to do this;

1.Export this registry key“HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares” on the old Server
2. Import it on the new server
3. Restart the new server

KB from Microsoft http://support.microsoft.com/kb/125996

windows server 2003 set wallpaper for all users through GPO

I have tested the procedures below on my side. In order to set the uniform wallpaper for users, you can refer to the steps below:

1. Create an OU and put all users that you want to set the wallpaper into it on domain.

2. Create a share folder and grant everyone has full control permission on it and put the wallpaper picture into this share.

3. Create a GPO, navigate to

User Configuration\Administrative Templates\Desktop\Active Desktop \Active Desktop Wallpaper

Set this item enable and in the wallpaper name column, input the share path that we created in step 2, for example \\servername\share\picture.jpg

After finishing, please click OK to confirm.

4. On the client pc, logon to PC using the user account included in the OU defined in first one step to test the result.

Unexpected Error 0x8ffe2740 when starting FTP or IIS

Another one of Microsoft’s descriptive errors is 0x8ffe2740 when trying to start an FTP or Web Server from the IIS Administration module. The error itself means that there is a port conflict with another service. This is a relatively easy diagnosis, as you should already know what ports your ftp or web servers use.

Use the netstat command in the command console to find out what program is using a particular TCP port. Replace the ## with the port you wish to test. This works on Windows Server 2003 and 2008.

netstat -anop TCP|find “:##”

The above command will return a PID (process ID). You will need to match that to a running program or service. Type the following command:

tasklist /SVC /FI “PID eq ####”

Here is an example using port 21. In this example you can see the “ftpsvc” service is using port 21 through svchost.exe – which is normal. In a client’s machine, it was MSUpdate2.exe that was using port 21 – a piece of malware using an FTP server to serve pirated movies!

Migrating websites from IIS6 to IIS7

Below are the steps required to move a website hosted on IIS6 to IIS7 (Internet Information Services 6 to 7). IIS7 replaces the aging metabase with a more convenient applicationHost.config which stores the configuration in XML.

There are two versions of MS Deploy, the program needed to migrate. Download the 32bit version here, and the x64 version here.

Installing MS Deploy on the Source IIS6 Server

1.       You must have .NET Framework 2.0 SP1 or 3.5 installed on the server.

2.       Download the file and open it. Choose Setup Type: Typical. Be sure to use the x64 version if you have Windows 2003 x64. There is no entry in the Start Menu; you need to start the program through the command prompt. C:\Program Files\Microsoft Web Deploy\msdeploy followed by the command.

Installing MS Deploy on the Destination IIS7 Server

1.       Same as above. Be sure to use the x64 version if you have Windows 2008 x64.

Create a Backup of the IIS7 configuration

It is important to create a backup of the IIS7 configuration before you start. You never know when you’ll make a mistake, and restoring IIS to the default configuration without a backup isn’t fun.

IIS7 comes with the appcmd.exe command line tool, which is new for IIS7, and simplifies configuration backups immensely. It is located in the %windir%\system32\inetsrv\ folder, which isn’t in the path variables, so you’ll need to navigate to that path with the command prompt first.

1.       Click Start -> Run -> type “cmd” and press OK.

2.       At the command prompt, navigate to the %windir%\system32\inetsrv\ folder. (type “cd \” and then “cd C:\Windows\system32\inetsrv” if windows is in the default path)

3.       Once in the target directory, type: appcmd add backup “BackupPreMigrate”

4.       Press Enter. All done.

5.       To display a list of previous backups type: appcmd list backup

6.       To restore a backup, type: appcmd restore backup “BackupPreMigrate”

Verify Dependencies on Source IIS6 Server

Below is a screenshot of all the variables supported by the migrate tool. All instructions below assume you are in the C:\Program Files\Microsoft Web Deploy\ directory at the command prompt.

1.     At the command prompt (In the C:\Program Files\Microsoft Web Deploy\ directory), type:

msdeploy –verb:getDependencies –source:metakey=lm/w3svc/#siteidentifier

The list that is returned is fairly comprehensive as to what components are installed and available for use on the particular website. It does not, however, distinguish which components are actually in use.

Installing Required Components on Destination IIS7 Server

From the dependency list you can determine which roles need to be installed on the destination IIS7 Server. Any dependencies listed in the XML file that is saved during the migration will need to be installed on the destination server or else the migration will not complete. You can remove dependencies beforehand or from within the XML file found in the backup directory after the sync command.

Migrate Website

• On the source IIS6 Server type:

msdeploy -verb:sync  -source:metakey=lm/w3svc/# siteidentifier -dest:archivedir=c:\backup_name

Move the backup folder (c:\backup_name) to the destination server, or if on a network simply backup to the final destination on the IIS7 server or SAN.

• On the destination IIS7 Server type:

msdeploy -verb:migrate -source:archivedir=c:\backup_name -dest:metakey=lm/w3svc/# siteidentifier

After Migration

After the migration is complete, some elements will need to be re-configured. PHP, ASP.NET Ajax and others will need to be configured independently of the IIS migration to match the source server’s settings.

Difference Between Windows 2003 and Windows 2008 Server?

1.2008 is combination of vista and windows 2003r2.

2. RODC one new domain controller introduced in it.[Read-only Domain Controllers.]

3.WDS (windows deployment services) instead of RIS in 2003 server

4. Shadow copy for each and every folders

5.Boot sequence is changed

5.Installation is 32 bit where as 2003 it is 16 bit as well as 32 bit, that’s why installation of 2008 is faster

6. Services are known as role in it

7. Group policy editor is a separate option in ads.

8. The main difference between 2003 and 2008 is Virtualization, management..

9.2008 has more inbuilt components and updated third party drivers Microsoft introduces new feature with 2k8 that is Hyper-V Windows Server 2008 introduces Hyper-V (V for Virtualization) but only on 64bit     versions.

10.In Windows Server 2008, Microsoft is introducing new features and technologies, some of which were not available in Windows Server 2003 with Service Pack 1 (SP1), that will help to reduce the power consumption of server and client operating systems, minimize environmental byproducts, and increase server efficiency.

11.Microsoft Windows Server 2008 has been designed with energy efficiency in mind, to provide customers with ready and convenient access to a number of new power-saving features. It includes updated support for Advanced Configuration and Power Interface (ACPI) processor power management (PPM) features, including support for processor performance states (P-states) and processor idle sleep states on multiprocessor systems. These features simplify power management in Windows Server 2008 (WS08) and can be managed easily across servers and clients using Group Policies.

12. Many features are updated - as security, IIS and RODC.In security it enable outbound firewall as well as inbound, IIS 7 release, Read only Domain controllers.

13.Virtualization

14.Server Core provides the minimum installation required to carry out a specific server role, such as for a DHCP, DNS or print server.

15.Boot sequence is changed

16.Role-based installation or, services are known as role in it

17.Better security

18.Enhanced terminal services

19.Network Access Protection

20. Microsoft's system for ensuring that clients connecting to Server 2008 are patched, running a firewall and in compliance with corporate security policies.

21.PowerShell

22. IIS

23. Bitlocker

24.System drive encryption can be a sensible security measure for servers located in remote branch offices.More and more companies are seeing this as a way of reducing hardware costs by running several 'virtual' servers on one physical machine. If you like this exciting technology, make sure that you buy an edition of Windows Server 2008 that includes Hyper-V, then launch the Server Manger, add Roles.

Windows Server 2008, formerly codenamed Longhorn, is no leas than 45 times faster than its predecessor, Windows Server 2003, in terms of network transfer speeds. Now whatever the perspective is on Microsoft's last 32-bit server operating system, the fact of the matter is that faster transfer speeds for of up to 45 times is quite an evolution compared to Windows Server 2003

25. Windows Aero

26.we can install windows 2008 server either in full version(install all services& applications) or server core(only install minimal required services), but in 2003 we can only install fully O.S.

27.Windows server 2008 use Hyper-V application & Roles concept for better productivity but server 2003 does not have such features.

28. Windows Server 2008, Active Directory has been renamed to Active Directory DomainServices (AD DS). AD DS retains the tools, architectural design, and structure that were introduced in Windows 2000 Server and Windows Server 2003, with some added improvements.

29.2003 was made to control XP networks.

30.2008 is made to control Vista networks.

31.The group policy and active directory schemas have been altered to include Vista polices. 

Reset Password in Windows Server 2008 (RTM and R2) and Windows 7

OK, time to fess up here.  I screwed up, so needed to find out how to do this for a machine we set up some time back that has been sitting idle - I was *sure* I recorded the authentication details in the OneNote build documentation for this client, but for the life of me, I can't find it.  Now I need to finish the install and, well, that's a little difficult without logon details...

So, I Googled and found these instructions that I've added to a bit (net group) and added some handy screen captures as well:

1. Boot from DVD or USB media - this media can be Windows Server 2008 RTM, 2008 R2, SBS 2008 or even Windows 7.

2. Change the language to English (Australia) if you want - but we're not installing anything, so it really doesn't matter right now

3. Click on the "Repair your computer" link

4. Choose the OS instance that you wish to reset the Administrator (or other Administrative) password for, taking note of the drive letter that was chosen for it (normally D:)

5. Choose "Command Prompt"

6. Change to the Windows\System32 directory of this OS instance and move the Utilman.exe file to a  backup, then copy cmd.exe to Utilman.exe

7. Remove the USB Key, reboot into the Windows install you need to change the password for and when at the Login prompt, hit Windows+U


8. Type 'net group "Domain Users"' to see a list of all the domain users on this system (Domain Controllers only)

9. Type 'net group "Domain Admins"' to see which administrative accounts exist on the system (Domain Controllers only) then type 'net user Administrator Select_a_decent_passphrase' to change the password of the Administrator account

10. Log in using the new password.  Immediately go and change this password to a nice, secure passphrase.


11. Reboot with the DVD/USB boot media and copy the backed up Utilman.exe.bak file to Utilman.exe to make sure we don't leave this hole open for now.  And that's it!  :)

Reset Windows 2008 R2 administrator password

This is the old trick of overwriting any app accessible at login screen (e.g. screen saver) with a command shell to reset the password


In this case I am going to use the "Utility Manager", that little accessibility button at the lower left corner that says in the tooltip: Ease of access

I first booted from the Windows 2008 R2 setup cd to launch System Repair, you can use Linux or any bootable cd that will give you write access to the NTFS file system. All you need to do is a couple of rename and copy operations.

Lanch System Repair and choose your windows installation

Browse to your System32 directory and run the following

ren Utilman.exe Utilman.exe.bak
copy cmd.exe Utilman.exe

Next restart and boot your windows instead of the cd.
At the login screen click the accessibility button or press Win+U

Now you have a command shell with SYSTEM privileges, reset the password with the net user command.

net user administrator eshta!

That's it.
Login and don't forget to restore the original Utilman.exe back

Windows Server Support Interview Questions and Answers (L2) Part 2

How to manually configure FSMO Roles to separate DC’s 

How can I determine who are the current FSMO Roles holders in my domain/forest?

Windows 2000/2003 Active Directory domains utilize a Single Operation Master method called FSMO (Flexible Single Master Operation), as described in Understanding FSMO Roles in Active Directory. 

The five FSMO roles are:

• Schema master - Forest-wide and one per forest. 

• Domain naming master - Forest-wide and one per forest. 

• RID master - Domain-specific and one for each domain. 

• PDC - PDC Emulator is domain-specific and one for each domain. 

• Infrastructure master - Domain-specific and one for each domain. 

In most cases an administrator can keep the FSMO role holders (all 5 of them) in the same spot (or actually, on the same DC) as has been configured by the Active Directory installation process. However, there are scenarios where an administrator would want to move one or more of the FSMO roles from the default holder DC to a different DC. The transferring method is described in the Transferring FSMO Roles article, while seizing the roles from a non-operational DC to a different DC is described in the Seizing FSMO Roles article. 

In order to better understand your AD infrastructure and to know the added value that each DC might possess, an AD administrator must have the exact knowledge of which one of the existing DCs is holding a FSMO role, and what role it holds. With that knowledge in hand, the administrator can make better arrangements in case of a scheduled shut-down of any given DC, and better prepare him or herself in case of a non-scheduled cease of operation from one of the DCs.

How to find out which DC is holding which FSMO role? Well, one can accomplish this task by many means. This article will list a few of the available methods.

Method #1: Know the default settings

The FSMO roles were assigned to one or more DCs during the DCPROMO process. The following table summarizes the FSMO default locations:

FSMO Role Number of DCs holding this role Original DC holding the FSMO role
Schema One per forest The first DC in the first domain in the forest (i.e. the Forest Root Domain)
Domain Naming One per forest 
RID One per domain The first DC in a domain (any domain, including the Forest Root Domain, any Tree Root Domain, or any Child Domain)
PDC Emulator One per domain 
Infrastructure One per domain 

Method #2: Use the GUI

The FSMO role holders can be easily found by use of some of the AD snap-ins. Use this table to see which tool can be used for what FSMO role:

FSMO Role Which snap-in should I use?
Schema Schema snap-in
Domain Naming AD Domains and Trusts snap-in
RID AD Users and Computers snap-in
PDC Emulator 
Infrastructure 

Finding the RID Master, PDC Emulator, and Infrastructure Masters via GUI

To find out who currently holds the Domain-Specific RID Master, PDC Emulator, and Infrastructure Master FSMO Roles:

1. Open the Active Directory Users and Computers snap-in from the Administrative Tools folder. 
2. Right-click the Active Directory Users and Computers icon again and press Operation Masters. 
3. Select the appropriate tab for the role you wish to view. 
4. When you're done click close. 

Finding the Domain Naming Master via GUI

To find out who currently holds the Domain Naming Master Role:
1. Open the Active Directory Domains and Trusts snap-in from the Administrative Tools folder. 
2. Right-click the Active Directory Domains and Trusts icon again and press Operation Masters. 
3. When you're done click close. 

Finding the Schema Master via GUI

To find out who currently holds the Schema Master Role:
1. Register the Schmmgmt.dll library by pressing Start > RUN and typing: 
2. Press OK. You should receive a success confirmation. 
3. From the Run command open an MMC Console by typing MMC. 
4. On the Console menu, press Add/Remove Snap-in. 
5. Press Add. Select Active Directory Schema. 
6. Press Add and press Close. Press OK. 
7. Click the Active Directory Schema icon. After it loads right-click it and press Operation Masters.
8. Press the Close button. 

Method #3: Use the Ntdsutil command

The FSMO role holders can be easily found by use of the Ntdsutil command.

Caution: Using the Ntdsutil utility incorrectly may result in partial or complete loss of Active Directory functionality.
1. On any domain controller, click Start, click Run, type Ntdsutil in the Open box, and then click OK. 
2. Type roles, and then press ENTER. 

Note: To see a list of available commands at any of the prompts in the Ntdsutil tool, type ?, and then press ENTER.
3. Type connections, and then press ENTER. 
4. Type connect to server , where is the name of the server you want to use, and then press ENTER. 
5. At the server connections: prompt, type q, and then press ENTER again. 
6. At the FSMO maintenance: prompt, type Select operation target, and then press ENTER again. 

At the select operation target: prompt, type List roles for connected server, and then press ENTER again. 

select operation target: List roles for connected server

Server "server100" knows about 5 roles

Schema - CN=NTDS Settings,CN=SERVER100,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=C

onfiguration,DC=dpetri,DC=net

Domain - CN=NTDS Settings,CN=SERVER100,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=C

onfiguration,DC=dpetri,DC=net

PDC - CN=NTDS Settings,CN=SERVER100,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Conf

iguration,DC=dpetri,DC=net

RID - CN=NTDS Settings,CN=SERVER100,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Conf

iguration,DC=dpetri,DC=net

Infrastructure - CN=NTDS Settings,CN=SERVER100,CN=Servers,CN=Default-First-Site-Name,CN=Si

tes,CN=Configuration,DC=dpetri,DC=net

select operation target:

8. Type q 3 times to exit the Ntdsutil prompt. 

Note: You can download THIS nice batch file that will do all this for you (1kb).

Another Note: Microsoft has a nice tool called Dumpfsmos.cmd, found in the Windows 2000 Resource Kit (and can be downloaded here: Download Free Windows 2000 Resource Kit Tools). This tool is basically a one-click Ntdsutil script that performs the same operation described above.

Method #4: Use the Netdom command

The FSMO role holders can be easily found by use of the Netdom command.

Netdom.exe is a part of the Windows 2000/XP/2003 Support Tools. You must either download it separately (from here Download Free Windows 2000 Resource Kit Tools) or by obtaining the correct Support Tools pack for your operating system. The Support Tools pack can be found in the \Support\Tools folder on your installation CD (or you can Download Windows 2000 SP4 Support Tools, Download Windows XP SP1 Deploy Tools). 

1. On any domain controller, click Start, click Run, type CMD in the Open box, and then click OK.
2. In the Command Prompt window, type netdom query /domain: fsmo (where is the name of YOUR domain). 

Close the CMD window.

Note: You can download THIS nice batch file that will do all this for you (1kb).

Method #5: Use the Replmon tool

The FSMO role holders can be easily found by use of the Netdom command. 

Just like Netdom, Replmon.exe is a part of the Windows 2000/XP/2003 Support Tools. Replmon can be used for a wide verity of tasks, mostly with those that are related with AD replication. But Replmon can also provide valuable information about the AD, about any DC, and also about other objects and settings, such as GPOs and FSMO roles. Install the package before attempting to use the tool.

1. On any domain controller, click Start, click Run, type REPLMON in the Open box, and then click OK. 
2. Right-click Monitored servers and select Add Monitored Server. 
3. In the Add Server to Monitor window, select the Search the Directory for the server to add. Make sure your AD domain name is listed in the drop-down list. 
4. In the site list select your site, expand it, and click to select the server you want to query. Click Finish. 
5. Right-click the server that is now listed in the left-pane, and select Properties. 
6. Click on the FSMO Roles tab and read the results. 
7. Click Ok when you're done. 

How can I forcibly transfer (seize) some or all of the FSMO Roles from one DC to another?

Windows 2000/2003 Active Directory domains utilize a Single Operation Master method called FSMO (Flexible Single Master Operation), as described in Understanding FSMO Roles in Active Directory. 

The five FSMO roles are:

• Schema master - Forest-wide and one per forest. 
• Domain naming master - Forest-wide and one per forest. 
• RID master - Domain-specific and one for each domain. 
• PDC - PDC Emulator is domain-specific and one for each domain. 
• Infrastructure master - Domain-specific and one for each domain. 

In most cases an administrator can keep the FSMO role holders (all 5 of them) in the same spot (or actually, on the same DC) as has been configured by the Active Directory installation process. However, there are scenarios where an administrator would want to move one or more of the FSMO roles from the default holder DC to a different DC. 

Moving the FSMO roles while both the original FSMO role holder and the future FSMO role holder are online and operational is called Transferring, and is described in the Transferring FSMO Roles article.

However, when the original FSMO role holder went offline or became non operational for a long period of time, the administrator might consider moving the FSMO role from the original, non-operational holder, to a different DC. The process of moving the FSMO role from a non-operational role holder to a different DC is called Seizing, and is described in this article.

If a DC holding a FSMO role fails, the best thing to do is to try and get the server online again. Since none of the FSMO roles are immediately critical (well, almost none, the loss of the PDC Emulator FSMO role might become a problem unless you fix it in a reasonable amount of time), so it is not a problem to them to be unavailable for hours or even days. 

If a DC becomes unreliable, try to get it back on line, and transfer the FSMO roles to a reliable computer. Administrators should use extreme caution in seizing FSMO roles. This operation, in most cases, should be performed only if the original FSMO role owner will not be brought back into the environment. Only seize a FSMO role if absolutely necessary when the original role holder is not connected to the network.

What will happen if you do not perform the seize in time? This table has the info:

FSMO Role Loss implications

Schema The schema cannot be extended. However, in the short term no one will notice a missing Schema Master unless you plan a schema upgrade during that time.

Domain Naming Unless you are going to run DCPROMO, then you will not miss this FSMO role.

RID Chances are good that the existing DCs will have enough unused RIDs to last some time, unless you're building hundreds of users or computer object per week.

PDC Emulator Will be missed soon. NT 4.0 BDCs will not be able to replicate, there will be no time synchronization in the domain, you will probably not be able to change or troubleshoot group policies and password changes will become a problem.

Infrastructure Group memberships may be incomplete. If you only have one domain, then there will be no impact.

Important: If the RID, Schema, or Domain Naming FSMOs are seized, then the original domain controller must not be activated in the forest again. It is necessary to reinstall Windows if these servers are to be used again. 

The following table summarizes the FSMO seizing restrictions:
FSMO Role Restrictions
Schema Original must be reinstalled
Domain Naming 
RID 
PDC Emulator Can transfer back to original
Infrastructure 

Another consideration before performing the seize operation is the administrator's group membership, as this table lists:
FSMO Role Administrator must be a member of
Schema Schema Admins
Domain Naming Enterprise Admins
RID Domain Admins
PDC Emulator 
Infrastructure 

To seize the FSMO roles by using Ntdsutil, follow these steps:

Caution: Using the Ntdsutil utility incorrectly may result in partial or complete loss of Active Directory functionality.

1. On any domain controller, click Start, click Run, type Ntdsutil in the Open box, and then click OK. 
2. Type roles, and then press ENTER. 

Note: To see a list of available commands at any of the prompts in the Ntdsutil tool, type ?, and then press ENTER.

3. Type connections, and then press ENTER. 
4. Type connect to server , where is the name of the server you want to use, and then press ENTER. 
5. At the server connections: prompt, type q, and then press ENTER again. 
6. Type seize , where is the role you want to seize. For example, to seize the RID Master role, you would type seize rid master: 

Options are: 

7. You will receive a warning window asking if you want to perform the seize. Click on Yes. 
fsmo maintenance: Seize infrastructure master
Attempting safe transfer of infrastructure FSMO before seizure.
ldap_modify_sW error 0x34(52 (Unavailable).
Ldap extended error message is 000020AF: SvcErr: DSID-03210300, problem 5002 (UNAVAILABLE)
data 1722 
Win32 error returned is 0x20af(The requested FSMO operation failed. The current FSMO holde

r could not be contacted.)
)

Depending on the error code this may indicate a connection,

ldap, or role transfer error.
Transfer of infrastructure FSMO failed, proceeding with seizure ...
Server "server100" knows about 5 roles
Schema - CN=NTDS Settings,CN=SERVER200,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dpetri,DC=netDomain - CN=NTDS Settings,CN=SERVER100,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dpetri,DC=net
PDC - CN=NTDS Settings,CN=SERVER100,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dpetri,DC=net
RID - CN=NTDS Settings,CN=SERVER200,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dpetri,DC=net
Infrastructure - CN=NTDS Settings,CN=SERVER100,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=dpetri,DC=net

fsmo maintenance:

Note: All five roles need to be in the forest. If the first domain controller is out of the forest then seize all roles. Determine which roles are to be on which remaining domain controllers so that all five roles are not on only one server.

8. Repeat steps 6 and 7 until you've seized all the required FSMO roles. 
9. After you seize or transfer the roles, type q, and then press ENTER until you quit the Ntdsutil tool. 

Note: Do not put the Infrastructure Master (IM) role on the same domain controller as the Global Catalog server. If the Infrastructure Master runs on a GC server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a GC server holds a partial replica of every object in the forest.