AD-DC-06: FSMO role holder details should be retrievable
| ID | AD-DC-06 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Domain controllers |
| Security area | Infrastructure hardening |
| Resource type | DomainController |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Understanding FSMO (Flexible Single Master Operations) role distribution is critical for:
- Operational awareness: Knowing which DCs perform critical directory operations
- Disaster recovery: Being able to quickly seize roles if a DC fails
- Maintenance planning: Understanding impact of DC downtime
- Security monitoring: Tracking changes to FSMO role holders
The 5 FSMO roles are:
- Schema Master (forest-wide): Controls Active Directory schema updates
- Domain Naming Master (forest-wide): Controls domain additions and removals
- PDC Emulator (domain-wide): Primary DC for backward compatibility and time sync
- RID Master (domain-wide): Allocates relative IDs for security identifiers
- Infrastructure Master (domain-wide): Handles cross-domain object references
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Document your FSMO role holders and keep the documentation updated
- Ensure FSMO role holders are highly available DCs
- Place at least one role holder in a different site for geographic redundancy
- Monitor for unexpected FSMO role transfers
- Test FSMO role seizure procedures periodically
How the Test Works
Section titled “How the Test Works”This test retrieves the current FSMO role holders from the domain and forest objects, then displays:
- Which DC holds each FSMO role
- How many roles each DC holds
- Total number of unique FSMO role holders
Related Tests
Section titled “Related Tests”Test-MtAdDcAllFsmoRolesCount- Identifies DCs holding all 5 rolesTest-MtAdDomainControllerCount- Total DC count
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.