fsmo

FSMO roles, by WinRM

Returns, for each of the five FSMO roles, the domain controller that holds it, as the monitored domain controller knows it, and whether that holder accepts a connection on the LDAP port from the monitored domain controller. One watch is proposed, checked: a holder that does not answer.

How it works

The collector runs one PowerShell script, by WinRM, that reads the roles through the classes of .NET that Microsoft documents, and opens a TCP connection to each holder:

$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; $computer = Get-CimInstance Win32_ComputerSystem; $server = $computer.DNSHostName + '.' + $computer.Domain; $context = New-Object DirectoryServices.ActiveDirectory.DirectoryContext('DirectoryServer', $server); $dc = [DirectoryServices.ActiveDirectory.DomainController]::GetDomainController($context); $holders = [ordered]@{schema = $dc.Forest.SchemaRoleOwner.Name; 'domain-naming' = $dc.Forest.NamingRoleOwner.Name; pdc = $dc.Domain.PdcRoleOwner.Name; rid = $dc.Domain.RidRoleOwner.Name; infrastructure = $dc.Domain.InfrastructureRoleOwner.Name}; $roles = @(foreach ($role in $holders.Keys) { $reachable = $false; try { $tcp = New-Object Net.Sockets.TcpClient; $reachable = $tcp.BeginConnect($holders[$role], 389, $null, $null).AsyncWaitHandle.WaitOne(3000) -and $tcp.Connected; $tcp.Close() } catch { }; @{role = $role; holder = $holders[$role]; reachable = $reachable} }); ConvertTo-Json -Compress -Depth 4 -InputObject @{roles = $roles}

• WinRM hands the script to PowerShell itself: the script is the one of active-directory/ssh/fsmo, without the powershell -Command "…" that cmd.exe needs there.
• The monitored domain controller is named by its full DNS name, read in Win32_ComputerSystem (DNSHostName and Domain), and the roles are read on it: DomainController.GetDomainController, then Forest.SchemaRoleOwner, Forest.NamingRoleOwner, Domain.PdcRoleOwner, Domain.RidRoleOwner and Domain.InfrastructureRoleOwner (Microsoft, .NET, System.DirectoryServices.ActiveDirectory).
• The roles, one instance each: schema (schema master), domain-naming (domain naming master), pdc (PDC emulator), rid (RID master), infrastructure (infrastructure master). The first two belong to the forest, the other three to the domain of the monitored domain controller.
• A holder is reachable when it accepts a TCP connection on port 389 within 3 seconds; nothing is sent on the connection. A bind with the account is not tried: a WinRM session authenticated by NTLM cannot hand its credentials on to another server, and every holder would then look refused. A name that does not resolve counts as unreachable.
• Fewer than five roles, or an answer that is not the expected JSON, stops the collector as misconfigured, as does a domain controller that the .NET classes cannot reach.

Nothing is written to the Windows or to the directory: the script only reads, and the connections send nothing.

Prerequisites

• A domain controller running Windows Server 2012 or later, with Windows PowerShell 3.0 or later.
• The WinRM service listening in HTTPS, on TCP 5986 or the port set in protocol:winrm:port, open in the Windows firewall to the poller, with a certificate the poller judges by the TLS profile of the probe or pins in protocol:winrm:fingerprint: the steps are those of the windows/winrm/services collector of banshee/windows-collection. NTLM authentication, which the WinRM service accepts as installed.
• An account of the domain for monitoring, without administrator rights, set in protocol:winrm:user (DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the group "Remote Management Users" of the domain (on a domain controller, the built-in group of the Builtin container). No other group: the holders of the roles are read in the directory, which any account of the domain reads.
• TCP 389 open from the monitored domain controller to the other domain controllers, as Active Directory needs it anyway.

Outputs

Watches

Limits

• The holders are those the monitored domain controller knows: one whose replication lags may name a former holder. The replication collector watches the lag.
• A holder that accepts a connection on port 389 may still fail to serve its role; the test says it is up and reachable, not that the role works.
• Not yet checked on a real domain controller: the execution; that reading a role owner does not contact its holder (only its name is read); that Win32_ComputerSystem.Domain is the DNS name of the domain on a domain controller.