Infrastructure Master in Windows 2000 Multi-Domain

In a multi-domain Microsoft Windows 2000 Active Directory environment, the Infrastructure Master is a critical Flexible Single Master Operations (FSMO) role responsible for updating cross-domain object references. This article explains the primary responsibilities of the Infrastructure Master, how it handles cross-domain group memberships, the critical placement rules regarding Global Catalog servers, and the operational impact if this role becomes unavailable.

Cross-Domain Reference Management

In a single-domain forest, all domain controllers possess complete information about all objects in that domain, rendering the Infrastructure Master largely inactive. However, in a multi-domain Windows 2000 forest, users from one domain are frequently added to universal or domain local groups residing in another domain.

When a group contains a member from another domain, it references that member using a Security Identifier (SID), a Globally Unique Identifier (GUID), and a Distinguished Name (DN). If the foreign object's name changes or the object moves within its home domain, the referencing domain must update its records. The Infrastructure Master handles this synchronization by periodically querying a Global Catalog server to compare its references against forest-wide changes and replicating any updates to all other domain controllers in its local domain.

Phantom Records

To manage foreign objects without replicating full directory partitions from other domains, the Infrastructure Master creates lightweight placeholder database entries called "phantom records." These records contain:

  • The object's GUID
  • The object's SID
  • The object's Distinguished Name (DN)

When an administrator views group memberships across domain boundaries, the Infrastructure Master ensures the phantom records translate raw SIDs into readable account names.

The Global Catalog Placement Rule

A fundamental operational rule in Windows 2000 multi-domain environments is that the Infrastructure Master role must not be assigned to a Domain Controller that also functions as a Global Catalog (GC) server, unless every Domain Controller in the domain is also a Global Catalog server.

The reason for this rule is architectural:

  1. A Global Catalog server holds a partial, read-only replica of every object in the forest.
  2. Because it contains forest-wide objects, a GC server never creates phantom records.
  3. If the Infrastructure Master resides on a GC server, it assumes all foreign references are already locally complete and ceases to detect changes or update phantom records.
  4. Consequently, non-GC domain controllers in that domain will never receive updates for renamed or moved foreign security principals.

In multi-domain configurations, the Infrastructure Master must be hosted on a standard domain controller with reliable network connectivity to a Global Catalog server in the same site.

Impact of Infrastructure Master Failure

If the Infrastructure Master becomes offline or unavailable, the domain continues to authenticate users and process daily directory requests without immediate interruption. However, prolonged downtime causes the following issues:

  • Renamed or moved user accounts in foreign domains will continue to display their outdated names in local group membership lists.
  • Newly added cross-domain accounts may temporarily display as unresolved SIDs rather than user names in administrative tools like Active Directory Users and Computers.

Temporary outages do not require an immediate transfer or seizure of the role, but if the hosting domain controller experiences permanent failure, the Infrastructure Master role must be seized by another non-Global Catalog domain controller within the domain.