Scroll Top
Evotec Services sp. z o.o., ul. Drozdów 6, Mikołów, 43-190, Poland
+48 502 469 760
[email protected]

Active Directory – Move-AD Directory Server Operation Master Role: Access is denied

Active Directory – Move-AD Directory Server Operation Master Role: Access is denied
Move-ADDirectoryServerOperationMasterRole
By Przemyslaw Klys Active Directory PowerShell 6 stycznia, 2019

When working with Active Directory one of the common tasks is to move FSMO roles between servers. Well, maybe not that common but it happens from time to time where you have to move all or just some of the FSMO roles. For that purposes, there is single PowerShell command Move-ADDirectoryServerOperationalMasterRole. Sure you can do this via GUI but if there's one command available to fix it all why bother? To make the move one has to be a Domain Admin, Enterprise Admin and Schema Admin. Everything was going smoothly for some roles but wasn't working for others.

PS C:\Windows\system32> Move-ADDirectoryServerOperationMasterRole -OperationMasterRole SchemaMaster

cmdlet Move-ADDirectoryServerOperationMasterRole at command pipeline position 1
Supply values for the following parameters:
Identity: XXXXXXX

Move Operation Master Role
Do you want to move role 'SchemaMaster' to server 'XXXXXXX.domain.pl' ?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y
Move-ADDirectoryServerOperationMasterRole : Access is denied
At line:1 char:1
+ Move-ADDirectoryServerOperationMasterRole -OperationMasterRole Schema ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (XXXXXXX:ADDirectoryServer) [Move-ADDirector...ationMasterRole], ADExcept
   ion
    + FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.MoveADDirectorySer
   verOperationMasterRole
Access is denied for FSMO move role? What now?
Double check of groups my user has – correct.

ForestMode and DomainMode – Correct

PowerShell running as Administrator – correct

So what could be wrong? Nothing that can be considered wrong on first sight. The trick is (for whatever reason) to change your Primary group to Schema Admins.

By default, it should be Domain Users but if you're having problems with FSMO move, just set your Primary group to Schema Admins and you're good to go. Remember that you need to log out for the group changes to update properly. After you log back in you should be able to move FSMO role without a problem.

Przemyslaw Klys / About Author
System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.
More posts by Przemyslaw Klys

Posty powiązane

Using Win32_UserAccount WMI filter in PowerShell/Group Policies and what to avoid
Some months ago, I created PowerShell Script to create local administrative users on workstations – Create a local user or administrator account in Windows using PowerShell. It’s a bit overcomplicated, but the goal was it should work for Windows 7 and up, and that means supporting PowerShell 2.0. As part of that exercise, I’ve been using Win32_UserAccount WMI based query to find local users and manage them to an extent. While Get-LocalUser exists, it’s not suitable for the PowerShell 2.0 scenario. I also use the same query in GPO for WMI filtering. You can say it’s been a good friend of mine.
02 cze 2020
Show meeting details of a Exchange (Office 365) room calendar for other languages
Changing Exchange folder permissions in multilanguage Office 365 tenants
One of the tasks I often get when setting up new Office 365 tenant or installing Exchange Servers is to change the visibility of Room Mailboxes or in some cases even standard users. There’s nothing hard about it, and there are plenty of articles about it. It’s just three simple steps.
22 mar 2019
MicrosoftExchange
Exchange 2013 powershell errors out, and Exchange 2013 ECP doesn’t work correctly
0
22 mar 2015
Easy way to create diagrams using PowerShell and PSWriteHTML
A few months ago, when I was working on PSWriteWord and PSWriteHTML, I thought to myself that in 2020 if I’ll get time, I’ll try to create PSWriteVisio. While I wasn’t sure I would be able to make it past some concept, it was in my plans for 2020. It’s still 2019 though, and while working on Testimo for Active Directory Healthchecks, I thought it would be nice to have a visual representation of network, forest schema or replication. I couldn’t get this idea out of my head. I thought on using PSGraph from Kevin Marquette to generate image and import that to PSWriteHTML but it was a bit tricky and PSGraph requires external software to work – and has some additional steps for Windows, Mac or Linux.
29 wrz 2019
Mastering Active Directory Hygiene: Automating Stale Computer Cleanup with CleanupMonster
Have you ever looked at your Active Directory and wondered, „Why do I still have computers listed that haven’t been turned on since World Cup 2016?” Yeah, we’ve all been there. Keeping AD clean and up-to-date is like trying to organize your garage—it’s easy to put off until it becomes a total mess.
25 sie 2024
Emailimo merged into PSWriteHTML, IE support and no dependencies
If you don’t know this yet, I use PSWriteHTML a lot. That means I get to test it under a lot of different conditions. I use it in reports, emails for small, medium, and large companies. Today’s blog post summarizes the work I did in the last few weeks over different areas of PSWriteHTML.
12 lis 2019
Format-Streams
PowerShell – Working with Format-Table in Verbose, Debug, Output Streams
As you may know, PowerShell has multiple streams. Write-Output, Write-Error, Write-Warning, Write-Verbose, Write-Debug, and Write-Information. It also has Write-Host which until PowerShell 5 was a bit special. Since PowerShell 5.1 it’s a wrapper over Write-Information, so it doesn’t kill puppies anymore. While I could spend the next five pages trying to give my best and describe those streams, there are already many articles describing them in detail. Please check the following link if you need that information.
18 lis 2018
Missing Permissions Authenticated Users
Finding GPOs missing permissions that may prevent GPOs from working correctly
I’ve been in IT for a longer time now. I’ve made my fair share of mistakes and misconfigurations. One of those misconfigurations was removing Authenticated Users from Security filtering in Group Policy Objects. While it worked fine at some point Microsoft rolled out a Hotfix MS16-07 on June 14th 2016.
19 lut 2020
AccountLockout
Active Directory – How to track down why and where the user account was locked out
I’ve been working with Windows Events for a while now. One of the things I did to help me diagnose problems and reporting on Windows Events was to write PSEventViewer to help to parse the logs and write PSWinReporting to help monitor (with use of PSEventViewer) Domain Controllers for events that happen across the domain. It’s handy and I, get those excellent daily reports of what happened while I was gone.
24 sty 2019
Dashimo
Meet Dashimo – PowerShell Generated Dashboard
Today I wanted to introduce a little product that I’ve created in the last few weeks called Dashimo. It doesn’t cover everything I wanted from it (feature wise), but it already can be used in production. Therefore, I thought it would be a good idea to get some feedback on whether I should spend some more time on it or throw it in the dumpster. Dashimo joins it’s older brother Statusimo of PowerShell modules allowing an easy way to build HTML output. If it will feel familiar, it’s because it was inspired with Bradley Wyatt PowerShell script he did. It gave me the idea of how I would like to build something similar but in a bit different way then he did, with much more flexibility. Still, if it wasn’t for him, the idea wouldn’t be there, therefore you should send him your thanks.
01 kwi 2019
Duplicate SPNs
Finding duplicate SPN with PowerShell
Duplicate SPNs aren’t very common but can happen in any Active Directory as there’s no built-in way that tracks and prevent duplicate SPN’s. One has to either know all SPN’s in the environment, track them or check each time whether it already exists or not. Things get more complicated with larger Active Directory environments as people change, new apps are added, old apps are forgotten, but SPNs prevail.
07 gru 2021
PowerShell – Single PSM1 file versus multi-file modules
I’ve been working with PowerShell Modules for a while now, and most of my knowledge about them came from Warren F (psCookieMonster) blog about Building a PowerShell Module. It is a handy piece of information and recommended read for anyone starting up writing PowerShell Modules. He introduces an idea where a module is stored in multiple folders Private, Public, Bin, Lib and so on and having YourModule.psm1 as a wrapper for functions, binaries in those folders, where each function is stored in its file. It’s an excellent concept, and I use it every day. It allows me to jump into a file quickly I want to find and fundamentally easier for development, especially in teams.
16 lis 2018
Upload and Download files from Azure Blob Storage using Connection String
They say there is a first time for everything. For me, it’s how to download and upload files to Azure Blog Storage using Connection String. Recently I was given Connection String, Container name and had to download some files from Azur Blog Storage. After some research and trying Connect-AzAccount, I found that the proper way to go is thru New-AzStorageContext.
18 sty 2023
PowerShell – How to check response code from a website
0
28 paź 2015
PSWinDocumentation
PSWinDocumentation – Export to Word, Excel, SQL of AD, AWS, Exchange, O365 Exchange, O365 Azure AD
Today I’m pushing forward with PSWinDocumentation project. I’ve fixed some bugs but I also added a couple of new features. I did lie a bit in the first sentence because this time it’s not all me. I got help from Mateusz Niemczyk who is a certified AWS engineer working for Euvic with me on some projects. If you’ve not yet guessed where I got him involved from the introduction – yes we’re adding basic AWS data support to PSWinDocumentation. But that’s not all…
23 wrz 2018