Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
[email protected]

Active Directory – Move-AD Directory Server Operation Master Role: Access is denied

Active Directory – Move-AD Directory Server Operation Master Role: Access is denied
Move-ADDirectoryServerOperationMasterRole
By Przemyslaw Klys Active Directory PowerShell 6 stycznia, 2019

When working with Active Directory one of the common tasks is to move FSMO roles between servers. Well, maybe not that common but it happens from time to time where you have to move all or just some of the FSMO roles. For that purposes, there is single PowerShell command Move-ADDirectoryServerOperationalMasterRole. Sure you can do this via GUI but if there's one command available to fix it all why bother? To make the move one has to be a Domain Admin, Enterprise Admin and Schema Admin. Everything was going smoothly for some roles but wasn't working for others.

PS C:\Windows\system32> Move-ADDirectoryServerOperationMasterRole -OperationMasterRole SchemaMaster

cmdlet Move-ADDirectoryServerOperationMasterRole at command pipeline position 1
Supply values for the following parameters:
Identity: XXXXXXX

Move Operation Master Role
Do you want to move role 'SchemaMaster' to server 'XXXXXXX.domain.pl' ?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y
Move-ADDirectoryServerOperationMasterRole : Access is denied
At line:1 char:1
+ Move-ADDirectoryServerOperationMasterRole -OperationMasterRole Schema ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (XXXXXXX:ADDirectoryServer) [Move-ADDirector...ationMasterRole], ADExcept
   ion
    + FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.MoveADDirectorySer
   verOperationMasterRole
Access is denied for FSMO move role? What now?
Double check of groups my user has – correct.

ForestMode and DomainMode – Correct

PowerShell running as Administrator – correct

So what could be wrong? Nothing that can be considered wrong on first sight. The trick is (for whatever reason) to change your Primary group to Schema Admins.

By default, it should be Domain Users but if you're having problems with FSMO move, just set your Primary group to Schema Admins and you're good to go. Remember that you need to log out for the group changes to update properly. After you log back in you should be able to move FSMO role without a problem.

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Posty powiązane

CodeADSI
Removing user from local administrator group based on data stored in Active Directory
We need to deal with a group names through SID’s rather than names because each group name is different in different languages. The second problem is to distinguish whether a user is a local or domain user. Finally, I need to connect to Active Directory to verify if the user I am about to remove has ExtensionAttribute10 (or any other field in AD) filled in or not.
17 lis 2019
MicrosoftExchange
Exchange 2013 powershell errors out, and Exchange 2013 ECP doesn’t work correctly
0
22 mar 2015
Getting Windows 10 build version from Active Directory
Today I saw an article on how to get Windows Version Report from Active Directory and thought that this is a cool idea. Something handy for migration scenarios or information on how up to date is your infrastructure. Since there are many ways to do the same thing I decided to tackle this myself and further include it into PSWinDocumentation.AD project. By default Active Directory stores Operating System and Operating System Version but it doesn’t really show versions one may expect.
14 cze 2019
Write-Color is now published as PowerShell Module
07 maj 2018
Creating Office 365 Migration Diagram with PowerShell
A few weeks ago, I posted a concept migration diagram for Office 365 to Twitter and Facebook. Today I thought I would show you how you can do it yourself using PowerShell and PSWriteHTML PowerShell module. When I started working on this, I’ve thought I want to create before and after infrastructure to see how it will look when migration ends. I’ve initially planned to assign myself an Office 365 Visio Plan 2 license and do something manually, thinking it may be just much easier. Unfortunately for me, there were no free Visio licenses in my tenant, and my laziness took over, so I’ve decided to give it a go using PowerShell only.
03 sty 2021
Visually display Active Directory Trusts using PowerShell
Active Directory Trusts are useful to connect one or more domains. But as useful those are, they can be very dangerous. Also, keeping trusts working and in good shape should be a top priority for Active Directory Admins. While there is a couple of command in the Active Directory module Get-ADTrust, I thought I would try and write my own that checks a few more things. I want to thank Chris Dent for his input on the part of this command. His binary skills amaze me!
14 wrz 2020
Track Ubiquiti Unifi Stock, and get notified of changes
I am a pretty big fan of Ubiquiti and their Unifi products line. Whether it’s network equipment or their camera systems, Unifi Protect, I have it all, and I’m pretty happy with how it works. However, over the last two years, some of their stocks in the store were very hard to find. For example, I’ve searched for Unifi Protect G4 Doorbell Pro for over six months. I’ve tried local shops all around Europe, even in the Ubiquiti Europe store, to never found any of them.
16 kwi 2023
Monitoring LDAPS connectivity/certificate with PowerShell
Some time ago, I wrote a blog post on checking for LDAP, LDAPS, LDAP GC, and LDAPS GC ports with PowerShell. It mostly works, but it requires a tad bit of effort, and it doesn’t cover the full scope that I wanted. Recently (well over 3 years ago), Chris Dent shared some code that verifies the LDAP certificate, and I thought this would be good to update my cmdlets to support just that with a bit of my own magic on top.
02 mar 2021
Removing Comments from PowerShell files/scripts
How to Efficiently Remove Comments from Your PowerShell Script
As part of my daily development, I create lots of code that I subsequently comment on and leave to ensure I understand what I tried, what worked, and what didn’t. This is my usual method of solving a problem. Sure, I could commit it to git and then look it up, and I do that, but that doesn’t change my behavior where I happen to have lots of “junk” inside of my functions that stay commented out. While this works for me, and I’ve accepted this as part of my process, I don’t believe this should be part of the production code on PowerShellGallery or when the code is deployed.
20 sie 2023
PSTeams
Sending Messages to Microsoft Teams from PowerShell just got easier and better
Christmas time is upon us, and I’ve decided that my PSTeams module needs some love. I wrote it in late 2018 and updated it a few times at the beginning of 2019. This release hopefully is worth of having 1.0 version number. I don’t do that often and usually go for build numbers changes only, but Microsoft Teams message cards have their limits on functionality. Therefore, there are not many things that can be added unless Microsoft opens up and gives us all the cool features of Adaptive Cards. PSTeams module uses Webconnector to send messages to Teams. That method only supports Message Cards, which even Microsoft calls Legacy. But legacy doesn’t mean fully functional with some cool features of their own. If you’re new to PSTeams you may want to read those 2 posts below to get information how to set it up.
22 gru 2019
Visually display Active Directory Nested Group Membership using PowerShell
In the Active Directory PowerShell module, you have two commands to your disposal that help display group membership. Those are Get-ADGroup and Get-ADGroupMember. The first command contains property Members, which gives you DistinguishedName of all members, and Get-ADGroupMember can provide you either direct members or with Recursive switch all members recursively (skipping groups). Till a few weeks ago, I was a happy user of those commands until I noticed two things. Member property for Get-ADGroup sometimes misses elements for whatever reason.
02 wrz 2020
Upload and Download files from Azure Blob Storage using Connection String
They say there is a first time for everything. For me, it’s how to download and upload files to Azure Blog Storage using Connection String. Recently I was given Connection String, Container name and had to download some files from Azur Blog Storage. After some research and trying Connect-AzAccount, I found that the proper way to go is thru New-AzStorageContext.
18 sty 2023
Office 365 - Inbox Rules
Office 365 – Find Users Forwarding Emails (PowerShell)
20 paź 2018
MicrosoftE xchange
Microsoft Exchange – Set Address Book Policy to multiple users based on group membership
0
28 sty 2016
Exchange 2013 – GrantSendOnBehalfTo nadpisuje wcześniejsze uprawnienia SendOnBehalf dla skrzynki pocztowej
0
22 sty 2016