Operations Master Role

Consequences if Role is Unavailable

Risk of Improper Restoration

Recommendation for Returning to Service After Seizure

Schema master

You cannot make changes to the schema.

Conflicting changes can be introduced to the schema if both schema masters attempt to modify the schema at the same time. This can result in a fragmented schema.

Not recommended. Can lead to a corrupted forest and require rebuilding the entire forest.

Domain naming master

You cannot add or remove domains from the forest.

You cannot add or remove domains or clean-up metadata. Domains might appear as though they are still in the forest even though they are not.

Not recommended. Can require rebuilding domains.

PDC emulator

You cannot change passwords on pre-Active Directory clients. No replication to Windows NT 4.0 backup domain controllers.

Password validation can randomly pass or fail. Password changes take much longer to replicate throughout the domain.

Allowed. User authentication can be erratic for a time, but no permanent damage occurs.

Infrastructure master

Delays displaying updated group membership lists in the user interface when you move users from one group to another.

Displays incorrect user names in group membership lists in the user interface after you move users from one group to another.

Allowed. May impact the performance of the domain controller hosting the role, but no damage occurs to the directory.

RID master

Eventually, domain controllers cannot create new directory objects as each of their individual RID pools is depleted.

Duplicate RID pools can be allocated to domain controllers, resulting in data corruption in the directory. This can lead to security risks and unauthorized access.

Not recommended. Can lead to data corruption that can require rebuilding the domain.