Adding or Removing a Domain During Dcpromo Requires Access to the Domain Naming Master FSMO Role Holder

The domain naming master Flexible Single Master Operations (FSMO) role holder is assigned to the domain controller that is responsible for making changes to the CN=Partitions,CN=Configuration, DC=domain configuration container in Active Directory. The configuration naming context is shared and replicated by all Windows 2000-based domain controllers in the same forest.

This article describes issues that can occur when Windows 2000-based servers that are being promoted or demoted are unable to contact the domain naming master FSMO role holder during Active Directory promotion or demotion.

The domain naming master FSMO role holder is the only computer that can add or remove a domain in a Windows 2000 Active Directory forest, and is the only FSMO role owner contacted by the Active Directory Installation Wizard (Dcpromo.exe). No FSMO role access is required to promote or demote replica domain controllers in an existing domain.

Investigate Domain Name System (DNS) name resolution, network connectivity, and consistency in Active Directory for the current domain naming master FSMO role holder when "naming master" or "FSMO" error messages occur during Dcpromo operations.

Active Directory Promotion

Windows 2000-based servers that are being promoted to domain controllers may generate the following error message when they are unable to contact the domain naming master FSMO role holder during promotion (in this case, the first domain controller of a new child domain, Y, of the root domain Z.COM): The %SystemRoot%\Debug\Dcpromo.log file shows similar information: A related message can occur when information about a new domain in the forest has not yet been replicated to the computer that is the intended holder of the domain naming FSMO role for the forest: This behavior can be caused by inconsistency in the domain naming master role owner as seen by different domain controllers in the forest because of replication latency or problems. Use the following troubleshooting steps to determine if a problem exists:

1. Confirm that the domain naming master is replicating Active Directory. Type repadmin /showreps at a command prompt.
2. Domain controllers in the forest are consistent about the computer name that is designated as the current domain naming master.
3. Confirm that the domain naming master is a global catalog server. Type nltest /dsgetdc:domainname /server:servername to see if the server is advertising the "GC" flag. New global catalog servers also register event 1119 ("This Windows domain controller is a now a global catalog server"). For additional information, click the article numbers below to view the articles in the Microsoft Knowledge Base:
   234790  (http://support.microsoft.com/kb/234790/EN-US/ ) How to Find FSMO Role Holders
   223787  (http://support.microsoft.com/kb/223787/EN-US/ ) Flexible Single Master Operation Transfer and SeizureProcess
   223346  (http://support.microsoft.com/kb/223346/EN-US/ ) FSMO Placement and Optimization on Windows 2000 Domains
4. If the domain naming master FSMO role holder is not a global catalog server, it locates another global catalog server to check for the creation. Determine whether the global catalog servers have finished promotion. Global catalog servers require a successful synchronization with a source for each domain. If there are error messages in the Event log about incomplete global catalog server promotion, try to correct the communication problem with all domains in the forest. Type nltest /dsgetdc:root.domain.name /server:servername, where servername is the correct server. Determine whether the server is advertising the "GC" entry in the flags section of the Nltest output.
   
   WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
   
   Set the logging verbosity for the Global Catalog entry under the HKLM\SYSTEM\CCS\Services\NTDS\DIAGNOSTICS registry key to 5, and then examine the directory service Event log.
5. The destination and installed parent domain are created on the domain naming master/global catalog server. Using Ldp.exe, connect to the global catalog server port (port 3268 ) on the domain naming master and search for objects in the appropriate domain(s) by navigating the tree. If they are not visible, examine the directory service Event logs to see why replication has not occurred.