What is the PDC emulator?
The PDC emulator is one of the five Active Directory FSMO (Flexible Single Master Operations) roles, also called operations master roles. It isn't software that imitates a domain controller: it's a set of jobs that exactly one domain controller in each domain performs. The name comes from Windows NT 4.0, where a single primary domain controller (PDC) held the only writable copy of the domain database and backup domain controllers (BDCs) held read-only copies. Active Directory lets every domain controller accept changes, but it kept a PDC role for compatibility with NT 4.0 systems and for tasks that work best in one place.
What the PDC emulator does
- Time source. Domain computers sync their clocks through the domain hierarchy, and the PDC emulator in the forest root domain sits at the top, syncing with an external NTP source. Time matters because Kerberos rejects logons when clocks differ by more than the allowed skew, 5 minutes by default.
- Password changes. Other domain controllers forward password changes to the PDC emulator right away. If a password fails on another DC, that DC checks with the PDC emulator before rejecting it, in case the password was just changed.
- Account lockouts. Lockouts are processed on the PDC emulator.
- Group Policy editing. The Group Policy management tools connect to the PDC emulator by default, which avoids conflicting edits to the same GPO on different DCs.
The five FSMO roles
| Role | Scope | Main job |
|---|---|---|
| Schema master | One per forest | Controls changes to the AD schema |
| Domain naming master | One per forest | Adds and removes domains in the forest |
| RID master | One per domain | Hands out pools of relative IDs used to build security identifiers (SIDs) |
| PDC emulator | One per domain | Time, password changes, lockouts, Group Policy edits |
| Infrastructure master | One per domain | Updates references to objects in other domains |
Working with the role
netdom query fsmolists which domain controllers hold each FSMO role.- To point the forest root PDC emulator at an external time source, run
w32tm /config /manualpeerlist:"time.nist.gov" /syncfromflags:manual /reliable:yes /updateand then restart the Windows Time service. w32tm /query /sourceshows where a computer gets its time.- If you move the role to another DC, set up the external time source on the new holder too. A role is normally transferred; it is seized only when the old holder is gone for good.
For the CompTIA A+ exam
The PDC emulator isn't named in the Core 1 (220-1201) objectives, but it appears in this course's NTP lesson because objective 2.3 lists NTP as a server role. Remember that domain-joined PCs get their time from domain controllers, which trace back to the PDC emulator, and that a PC whose clock is more than 5 minutes off can fail to sign in to the domain.