Why after I seize a FSMO role I can't transfer it back to its original DC?

Question

Everywhere I read about the FSMO roles it is written that after it is seized the FSMO role can not be transferred back to its original server.

Did someone knows why? Lets say that I seize the Schema Master and then I try to transfer it back? What will happen?

Of course that this does not apply to PDC Emulator or the Infrastructure master.

Solution

With the PDC Emulator and Infrastructure roles, this doesn't apply; they're able to recover just fine from a seizure, and can be transferred and seized all over the place to your heart's content.

With the rest (RID, Naming, and Schema), it's not that you can't transfer back. It's that the recommendation is to never turn a DC back on after the role has been seized from it. The risk is that the two DCs both think they own the role; divergent schema changes, overlapping RIDs, and overlapping domains in the forest are the potential results.

How difficult it is to create these scenarios is another matter entirely (knowledge of the seizure will replicate to the old role holder and it will cease thinking it's the master - broken replication/connectivity is needed to create any risk); the recommendation to not bring the old DC back online is made due to an abundance of caution on Microsoft's part.

If you have to seize a RID, Naming, or Schema master's role, the safe course is to nuke the DC's metadata from orbit and reinstall the OS.

Comments

[Spirit]

ROFL "nuke the DC's metadata from orbit".. Thanks for the link and the advice.. gonna remember this for good :)

[Jonathan J]

Don't confuse seizure of roles with transfer. Seizure should only be used in the event that the role holder has failed and cannot be brought back online; if the server is online and functional you should do a transfer. Any role that is transferred -- not seized -- can be returned to the server it was transferred from. When you seize a role, the original role holder thinks it still holds that role. If you bring it back online, there will be multiple holders of the role, and AD corruption could occur.