U-Tools: Unique Tools for Windows System Administrators
U-Move Help

Creating a Test Forest

Creating a test forest is useful for testing global changes to Active Directory such as elevating the Functional Level or adding new object classes to the schema. These changes are generally irreversible, so it is important that you test them carefully before you apply them to your production AD forest.

Microsoft recommends that you validate the compatibility of all security-related configuration changes in a test forest before you introduce them in a production environment.

To create a test forest it is not necessary to clone all of the domain controllers (DCs) in the forest.

For testing changes to the AD schema the following DCs are usually sufficient:

  1. The DC that has the Schema Master Role. It coordinates adding new object classes or new attribute types to the design (schema) of the AD database.
  2. The DC that hosts the primary DNS server.
  3. A DC that has the Global Catalog (GC).

For testing changes to inter-domain trusts or cross-domain security settings, the following DCs are usually sufficient:

  1. The DC that has the Primary Domain Controller (PDC) FSMO role, one for each domain.
  2. The DC that hosts the primary DNS server. (If different domains are hosted by different primary DNS servers you will need to include one primary DNS server for each domain.)
  3. A DC that has the Global Catalog (GC).
Copying FSMO Roles

Active Directory is a multi-master distributed database. This means that any DC can assume the role of a master for some task. These roles are called Flexible Single Master Operations roles, or FSMO (“fizz-moh”) roles.

Usually the PDC(s) will hold all of the FSMO roles. This is the most common case. Simply clone the PDC(s) to your test network and you are done.

Rare: In rare cases you may have assigned a non-PDC with a FSMO role. In addition to cloning the PDC(s) you will need to clone the DCs that hold the missing FSMO roles (see below).

About FSMO Roles

For detailed background information about the different FSMO roles see the topic FSMO Roles.

To view which DCs own the FSMO roles, type the console command netdom query fsmo.