Windows 2000 Active Directory Operations Master Roles

In a Microsoft Windows 2000 Active Directory forest, Operations Master roles—commonly referred to as Flexible Single Master Operation (FSMO) roles—prevent conflicting updates by assigning critical, non-multimaster tasks to single domain controllers. While Active Directory primarily operates on a multimaster replication model, certain operations require a single authority to ensure data integrity. These operations are divided into two forest-wide roles, which exist only once per forest, and three domain-wide roles, which exist once within every domain in the forest.

Forest-Wide Operations Master Roles

  • Schema Master: The Schema Master controls all modifications and updates to the Active Directory schema, which defines every object class and attribute that can exist within the forest. Any administrative change to the schema—such as installing schema-modifying applications like Microsoft Exchange 2000—must be processed directly by this server. Once modified on the Schema Master, changes replicate to all other domain controllers in the forest.
  • Domain Naming Master: The Domain Naming Master manages the addition or removal of domains, directory partitions, and external directory cross-references within the forest. To prevent two domains from being created with the same name simultaneously, any creation or deletion of a domain must be authorized by this single domain controller.

Domain-Wide Operations Master Roles

  • Relative Identifier (RID) Master: The RID Master allocates pools of unique Relative Identifiers to all domain controllers within its domain. When a domain controller creates a security principal (such as a user, group, or computer), it assigns a unique Security Identifier (SID) composed of the domain SID and a unique RID from its assigned pool. When a controller's pool runs low, it requests a new block of RIDs from the RID Master, ensuring no duplicate SIDs are generated.
  • PDC Emulator: The Primary Domain Controller (PDC) Emulator performs several critical administrative, security, and backward-compatibility tasks:
    • NT 4.0 Compatibility: It acts as a legacy Windows NT 4.0 PDC for down-level clients and Backup Domain Controllers (BDCs).
    • Password Management: When a user changes their password, the update is immediately pushed to the PDC Emulator. If an authentication attempt fails on another domain controller, that controller queries the PDC Emulator before rejecting the logon, reducing false rejections caused by replication latency.
    • Time Synchronization: The PDC Emulator at the root of the forest serves as the authoritative time source for the entire enterprise, while domain-level PDC Emulators synchronize time within their respective domains.
    • Group Policy Management: By default, Group Policy Objects (GPOs) opened in the administrative console are locked and edited on the PDC Emulator to prevent concurrent overwrite conflicts.
  • Infrastructure Master: The Infrastructure Master is responsible for updating cross-domain object references. When an object in one domain is added to a group in another domain, the Infrastructure Master translates the object's GUID, SID, and Distinguished Name to keep inter-domain references current. In Windows 2000 environments, this role should not be hosted on a domain controller running the Global Catalog (unless every domain controller in the domain hosts the Global Catalog), as the presence of the Global Catalog prevents the Infrastructure Master from detecting outdated cross-domain references.