Active Directory FSMO role seizure aftermath
Overview
Seizing FSMO roles after DC death is valid—metadata cleanup and replication health afterward separate pros from chaos.
Immediate checks
repadmin /replsummaryand DFS-R for SYSVOL state.- Schema / RID / Infrastructure owners correct in
netdom query fsmo. - Time sync anchored—PDC emulator reachable.
If old DC might return
Stale restore risks USN rollback; keep offline until demoted properly or flattened per disaster plan.
DNS/DHCP
Scavenge stale SRV hosts; verify DHCP failover partner still authorizing.
Documentation
Incident log: why seizure happened, whether hardware replaced, new backup baseline taken.
Post-incident
Add monitoring for RID pool consumption anomalies and DCDiag scheduled tests.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...