The Directory service is unavailable FSMO

When working with Active Directory one of the common tasks is to move FSMO roles between servers. Well, maybe not that common but it happens from time to time where you have to move all or just some of the FSMO roles. For that purposes, there is single PowerShell command Move-ADDirectoryServerOperationalMasterRole. Sure you can do this via GUI but if there's one command available to fix it all why bother? To make the move one has to be a Domain Admin, Enterprise Admin and Schema Admin. Everything was going smoothly for some roles but wasn't working for others.

PS C:\Windows\system32> Move-ADDirectoryServerOperationMasterRole -OperationMasterRole SchemaMaster

cmdlet Move-ADDirectoryServerOperationMasterRole at command pipeline position 1
Supply values for the following parameters:
Identity: XXXXXXX

Move Operation Master Role
Do you want to move role 'SchemaMaster' to server 'XXXXXXX.domain.pl' ?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): y
Move-ADDirectoryServerOperationMasterRole : Access is denied
At line:1 char:1
+ Move-ADDirectoryServerOperationMasterRole -OperationMasterRole Schema ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (XXXXXXX:ADDirectoryServer) [Move-ADDirector...ationMasterRole], ADExcept
   ion
    + FullyQualifiedErrorId : ActiveDirectoryServer:0,Microsoft.ActiveDirectory.Management.Commands.MoveADDirectorySer
   verOperationMasterRole

Access is denied for FSMO move role? What now?

Double check of groups my user has – correct.

ForestMode and DomainMode – Correct

PowerShell running as Administrator – correct

So what could be wrong? Nothing that can be considered wrong on first sight. The trick is (for whatever reason) to change your Primary group to Schema Admins.

By default, it should be Domain Users but if you're having problems with FSMO move, just set your Primary group to Schema Admins and you're good to go. Remember that you need to log out for the group changes to update properly. After you log back in you should be able to move FSMO role without a problem.

You could try a manual seize if nothing else works. this is a last resort though

 I second that, Sould be only a last ressort, because it could leave you in some cases with problems in your AD. (I've seen this once, we seized roles to another server from a server that went down than came back unexpectedly and wasn't isolated. created a little mess.).

Michael, are there any related events in your Eventlogs when you try to transfert schema master to Win2k8 ?

When a directory is impaired or inoperable, the directory status message contains additional information. The status message is displayed in the Amazon Directory Service console, or returned in the member by the DescribeDirectories API. For more information about the directory status, see Understanding your directory status.

The following are the status messages for a Simple AD directory:

The directory service's elastic network interface is not attached

Description

The critical elastic network interface (ENI) that was created on your behalf during directory creation to establish network connectivity with your VPC is not attached to the directory instance. Amazon applications backed by this directory will not be functional. Your directory cannot connect to your on-premises network.

If the ENI is detached but still exists, contact Amazon Web Services Support. If the ENI is deleted, there is no way to resolve the issue and your directory is permanently unusable. You must delete the directory and create a new one.

Issue(s) detected by instance

Description

An internal error was detected by the instance. This usually signifies that the monitoring service is actively attempting to recover the impaired instances.

In most cases, this is a transient issue, and the directory eventually returns to the Active state. If the problem persists, contact Amazon Web Services Support for more assistance.

The critical Amazon Directory Service reserved user is missing from the directory

Description

When a Simple AD is created, Amazon Directory Service creates a service account in the directory with the name AWSAdminD-xxxxxxxxx. This error is received when this service account cannot be found. Without this account, Amazon Directory Service cannot perform administrative functions on the directory, rendering the directory unusable.