Access is denied errors

This issue typically indicates a Kerberos authentication problem, although there are several exceptions. To resolve the replication failure in this case, resolve the authentication failure before you try to fix the replication problem. To resolve this issue:

1. Make sure the Access this computer from network user right in the source server's security policy includes the appropriate groups. To do this, check the <computername>_userrights.txt file in the Directory Services MPSReports to confirm which groups are listed. Everyone, Authenticated Users, and Enterprise Domain Controllers must have that user right for successful replication.

2. Make sure the Kerberos Key Distribution Center (KDC) service is started.

3. Make sure the Trust computer for delegation check box is selected on the General tab of the domain controller Properties dialog box in Active Directory Users and Computers.

4. Using Adsiedit or Ldp (both included in the Windows 2000 Support Tools), confirm that the userAccountControl attribute is set to 532480. To check this, perform the following steps:

• Type adsiedit.msc from Start, Run.
• Expand the Domain NC container.
• Expand the object below, i.e. DC=Contoso, DC=COM.
• Expand OU=Domain Controllers.
• Right-click CN=<domain_controller>, and select Properties.
• Under Select a property to view, select userAccountControl and verify the value is 532480.

5. If the problem exists between domain controllers from different domains, check the trust relationship by doing the following:

• Open Active Directory Domains and Trusts.
• Right-click the desired domain and select Properties.
• Click the Trusts tab.
• Highlight the domain to verify and click Edit.
• Click Verify.

The Netdom tool included in the Windows 2000 Support Tools can also be used to verify the trust.

netdom trust <trusting_domain_name> /domain:<trusted_domain_name> /userd:<administrator> /password:<password> /verify /kerberos

6. If replication is failing between domain controllers in different domains, follow these steps:

Add the following registry value to the upstream replication partner:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters

Value name:  Replicator Allow SPN Fallback
Value type:  REG_DWORD
Value data:  1

Run the following command from the upstream partner:
repadmin /add CN=Configuration,DC=<domain controller>,DC=<com> <root DC name> <fully qualified name of child domain controller>

Remove the Replicator Allow SPN Fallback registry value after testing replication.

7. Attempt to reset the computer account password and force a refresh of Kerberos tickets of the downstream partner.

netdom resetpwd /server:<DC> /userd:<domain>\administrator /passwordd:<password>

Note Run the command on the problem domain controller. <DC> is any domain controller other than the domain controller with an invalid password. Set the Kerberos Key Distribution Center (KDC) service to manual on the problem domain controller and reboot. Restart the KDC service and switch it back to automatic after the reboot is completed.

8. Make sure the Service Principal Name (SPN) is registered for each domain controller object on each partner domain controller. For more information see KB article 308111.

Review the Registered Service Principal Names section of the Netdiag output on partner domain controllers to ensure that the test passes. Export the SPNs of each domain controller object involved in the replication failure from each partner using the following command:

ldifde -f spndump.txt -p base -l servicePrincipalName -d <DN of DC>

Either visually compare the SPNs or use the Windiff tool from the Windows 2000 Support Tools to compare the files for differences. Under the Options menu in Windiff, uncheck everything except Show different files, Show left-only lines, and Show right-only lines. After identifying the missing SPNs, edit the good SPN file as follows:

• Change changetype:  add to changetype:  modify.
• Add replace:  servicePrincipalName after the changetype line.
• Add "-" to the last line of the file.

Import the correctly registered SPNs on the partner domain controllers that do not have proper SPNs registered for its replication partner domain controllers.

ldifde -I -f goodSPNs.txt

9. If the problem domain controllers exist in only one domain with more than two domain controllers, force all computer accounts to be replicated throughout the enterprise. That means all domain controllers must be synchronized with all other copies of their domain. For each computer that is reporting a replication error, use the following command to force that computer to become synchronized. The domain to synchronize must be specified. For more information see KB article 296993.

repadmin /syncall /d /e <problem domain controller> <DN of domain>

Note For large environments, remove the /e switch to replicate domain controllers with the same site, or use /sync to target specific domain controllers in remote sites.

10. If the failing domain controllers reside in different domains, then specify the configuration partition. For more information see KB article 296993.

repadmin /syncall /d /e <problem domain controller> <DN of config>

Note For large environments, remove the /e switch to replicate domain controllers with the same site or use /sync to target specific domain controllers in remote sites.

11. Make sure the Enterprise Domain Controllers group has the required permissions on the directory partition’s access control list (ACL):

• Start Active Directory Users and Computers.
• On the View menu, select Advanced Features.
• Right-click the root domain object, and then select Properties.
• Select the Security tab, click Enterprise Domain Controllers in the name list, and then make sure the following permissions are selected under Allow:
  • Manage Replication Topology.
  • Replicating Directory Changes.
  • Replication Synchronization.

12.  Use Active Directory Sites and Services to make sure the server object and its corresponding NTDS Settings child object exist in the correct site.

13. Verify the following Group Policy security options under Security Settings match on all partner domain controllers.

• Additional Restrictions for Anonymous Connections.
• Digitally Sign Client Communication (Always).
• Digitally Sign Client Communication (When Possible).
• Digitally Sign Server Communication (Always).
• Digitally Sign Server Communication (When Possible).
• LAN Manager Authentication Level.

14. Check for Kerberos fragmentation by typing ping <destination computer> -f -l 1500. Start with 1500 first, and then work up to 2000. If it fails before 2000, then packets are likely being fragmented. For more information see KB article 244474.

Monitor Domain Controller Performance

Monitors the performance of an Active Directory domain controller.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colDatabases = objWMIService.ExecQuery _
    ("Select * from Win32_PerfFormattedData_NTDS_NTDS")
For Each objADDatabase in colDatabases
    Wscript.Echo "DS threads in use: " & objADDatabase.DSThreadsInUse
    Wscript.Echo "LDAP bind time: " & objADDatabase.LDAPBindTime
    Wscript.Echo "LDAP client sessions: " & objADDatabase.LDAPClientSessions
Next

This is a VB Script, this can be used by saving the file in .vbs file

List Trust Relationships

Enumerates trust relationships

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & _
        strComputer & "\root\MicrosoftActiveDirectory")
Set colTrustList = objWMIService.ExecQuery _
    ("Select * from Microsoft_DomainTrustStatus")
For each objTrust in colTrustList
    Wscript.Echo "Trusted domain: " & objTrust.TrustedDomain
    Wscript.Echo "Trust direction: " & objTrust.TrustDirection
    Wscript.Echo "Trust type: " & objTrust.TrustType
    Wscript.Echo "Trust attributes: " & objTrust.TrustAttributes
    Wscript.Echo "Trusted domain controller name: " & objTrust.TrustedDCName
    Wscript.Echo "Trust status: " & objTrust.TrustStatus
    Wscript.Echo "Trust is OK: " & objTrust.TrustIsOK
Next

This is a VB Script, this can be used by saving the file in .vbs file

List Domain Information for Trust Partners

Returns local domain information.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & _
        strComputer & "\root\MicrosoftActiveDirectory")
Set colDomainInfo = objWMIService.ExecQuery _
    ("Select * from Microsoft_LocalDomainInfo")
For each objDomain in colDomainInfo
    Wscript.Echo "DNS name: " & objDomain.DNSName
    Wscript.Echo "Flat name: " & objDomain.FlatName
    Wscript.Echo "SID: " & objDomain.SID
    Wscript.Echo "Tree name: " & objDomain.TreeName
    Wscript.Echo "Domain controller name: " & objDomain.DCName
Next

This is a VB Script, this can be used by saving the file in .vbs file

Configure Trust Relationship Properties

Configures trust relationship refresh and validation properties

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & _
        strComputer & "\root\MicrosoftActiveDirectory")
Set colTrustList = objWMIService.ExecQuery _
    ("Select * from Microsoft_TrustProvider")
For Each objTrust in colTrustList
    objTrust.TrustListLifetime = 25
    objTrust.TrustStatusLifetime = 10
    objTrust.TrustCheckLevel = 1
    objTrust.Put_
Next

This is a VB Script, this can be used by saving the file in .vbs file

Replication topology and connectivity errors

The common causes of Event ID 1311 messages fall into two categories:  Improper logical configuration and Infrastructure failure. These events are logged when an improper logical configuration or a replication error occurs. For more information see KB article 307593.

1. Improper logical configuration.
   A logical configuration is improperly configured when information in the Configuration Naming Context (NC) does not match the physical topology of the network that hosts the Active Directory forest. For example, a site may not be properly defined, sites that are missing from site links may be included, site links may not be interconnected, or incorrect bridgeheads may have been configured.
   
2. Infrastructure failure.
   An infrastructure failure occurs as a result of one of more of the following events:
1. A wide area network (WAN) link fails.
2. A domain controller that hosts a necessary naming context is offline.
3. A replication failure occurs for one or more naming contexts.

For more information see KB article 307593.

LDAP bind error 31 errors

I. Attempt to reset the computer account password and force a refresh of Kerberos tickets:

• Use the Netdom tool from the Windows Support Tools to reset the machine account password.
  
  netdom resetpwd /server:<computername> /userd:<domain>\administrator /passwordd:<password>
  
  Note Run the command on the problem domain controller. <computername> is any domain controller other than the domain controller with the invalid password.
  
• Set the Kerberos Key Distribution Center (KDC) service to manual on the problem domain controller and reboot.
  
• After the reboot, start the KDC service and change it back to Automatic.
  
• If the problem persists even after the above steps, try the following:
1. Sometimes the HKEY_LOCAL_MACHINE\Security\Policy\PolAcDmN registry key is set to the computer name instead of the NetBIOS domain name. Use Regedt32 to view this value as Regedit does not display REG_BINARY values properly.
   
2. In Regedt32, highlight the No Name value and choose Display binary data from the View menu.
   
3. Confirm that the value in HKEY_LOCAL_MACHINE\Security\Policies\PolPrDmN is set to the NetBIOS domain name.
   
4. Copy that value and paste it into HKEY_LOCAL_MACHINE \Security\Policies\PolAcDmN.

II. Missing trustedDomain object.

If the trustedDomain object is missing, there will usually be an Event ID 1265 logged in the directory service event log referencing a "Target account name is incorrect" error. If the error is being reported for replication between two domain controllers of different domains which have a parent/child or tree root trust relationship, this error may be the result of a missing object that represents the trust relationship between the two domains. This object is known as a trustedDomain object and is found in the System container in Active Directory Users and Computers. If this object is not present, cross-domain authentication will fail. For more information see KB article 257844.

To resolve this issue perform the following steps:

Note This procedure should only be performed if the trustedDomain object for the remote domain is not present in the System container.

1. From the domain that is generating the Event ID 1265 or “LDAP Bind error 31” error messages, open Active Directory Domains and Trusts on the domain controller that holds the PDC Emulator operations master role for the domain. Right-click the object that represents the domain, and then select Properties.
   
2. Click the Trusts tab, and click Add to create both sides of the trust relationship to the remote domain. Because this would normally be a Kerberos trust, creating both sides of the trust is required. Creating the trusted side first generates the error message "Active Directory cannot verify the trust. Access is denied."
   
3. Click OK. Note that Active Directory Domains and Trusts displays the trust as a transitive, shortcut trust. Adding the trusting side generates the message "To verify the new trust, you must have permissions to administer trusts for the domain <domain name>. Do you want to verify the new trust?”
   
4. Click Yes, and supply the administrator credentials for the remote domain. When prompted for credentials, specify the NetBIOS domain name as well as the user name, i.e., CONTOSO\Administrator. The following error message is generated:  "Active Directory cannot verify the trust. Access is denied."
   
5. Click OK. Again, note that Active Directory Domains and Trusts displays the trust as a transitive, shortcut trust.
   
6. After both sides of the trust are created, run the Netdom command below (Netdom is included in the Windows 2000 Support Tools):
   
   netdom trust <local_domain> /domain:<remote_domain> /userd:administrator /passwordd:* /usero:administrator /passwordo:* /reset /twoway
   
   Where <local_domain> is the domain on which the trust is being created and <remote_domain> is the parent, child, or root domain being trusted. In either case, the fully qualified domain name (FQDN) should be used, i.e. "Contoso.com". This should result in the following message:
   
   Type the password associated with the domain user:  (This is UserD)
   
   Type the password associated with the object user:  (This is UserO)
   
   Resetting the trust passwords between <local_domain> and <remote_domain>. The trust between <local_domain> and <remote_domain> has been successfully reset and verified.
   
   The command completed successfully.
   
   
7. Reboot the domain controller where these changes were made.
   
8. After rebooting, wait several minutes for Active Directory to establish a secure channel and the Knowledge Consistency Checker (KCC) to attempt to re-establish replication links to the domain controllers in the remote domain. During this period, test that logons across the trust relationship are successful and that no errors are logged in the directory service event log.

Using WMI to Retrieve Domain Information

Retrieves information about domains discovered on the network.

On Error Resume Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_NTDomain")
For Each objItem in colItems
    Wscript.Echo "Client Site Name: " & objItem.ClientSiteName
    Wscript.Echo "DC Site Name: " & objItem.DcSiteName
    Wscript.Echo "Description: " & objItem.Description
    Wscript.Echo "Dns Forest Name: " & objItem.DnsForestName
    Wscript.Echo "Domain Controller Address: " & objItem.DomainControllerAddress
    Wscript.Echo "Domain Controller Address Type: " & _
        objItem.DomainControllerAddressType
    Wscript.Echo "Domain Controller Name: " & objItem.DomainControllerName
    Wscript.Echo "Domain Guid: " & objItem.DomainGuid
    Wscript.Echo "Domain Name: " & objItem.DomainName
    Wscript.Echo "DS Directory Service Flag: " & objItem.DSDirectoryServiceFlag
    Wscript.Echo "DS DNS Controller Flag: " & objItem.DSDnsControllerFlag
    Wscript.Echo "DS DNS Domain Flag: " & objItem.DSDnsDomainFlag
    Wscript.Echo "DS DNS Forest Flag: " & objItem.DSDnsForestFlag
    Wscript.Echo "DS Global Catalog Flag: " & objItem.DSGlobalCatalogFlag
    Wscript.Echo "DS Kerberos Distribution Center Flag: " & _
        objItem.DSKerberosDistributionCenterFlag
    Wscript.Echo "DS Primary Domain Controller Flag: " & _
        objItem.DSPrimaryDomainControllerFlag
    Wscript.Echo "DS Time Service Flag: " & objItem.DSTimeServiceFlag
    Wscript.Echo "DS Writable Flag: " & objItem.DSWritableFlag
    Wscript.Echo "Name: " & objItem.Name
    Wscript.Echo "Primary Owner Contact: " & objItem.PrimaryOwnerContact
    Wscript.Echo
Next

This is a VB Script, this can be used by saving the file in .vbs file

Moving a Domain Controller to a New Active Directory Site

Moves a domain controller from one Active Directory site (strSourceSiteRDN) to another Active Directory site (strTargetSiteRDN).

strSourceSiteRDN = "cn=Default-First-Site-Name"
strTargetSiteRDN = "cn=Ga-Atl-Sales"
strDcRDN         = "cn=atl-dc-01"
 
Set objRootDSE = GetObject("LDAP://RootDSE")
strConfigurationNC = objRootDSE.Get("configurationNamingContext")
 
strDcPath = "LDAP://" & strDcRDN & ",cn=Servers," & strSourceSiteRDN & _
    ",cn=Sites," & strConfigurationNC
 
strTargetSitePath = "LDAP://cn=Servers," & strTargetSiteRDN & _
    ",cn=Sites," & strConfigurationNC
 
Set objTargetSite = GetObject(strTargetSitePath)
objTargetSite.MoveHere strDcPath, strDcRDN

This is a VB Script, this can be used by saving the file in .vbs file

Identifying Your Domain Controller

Returns the name of the domain controller that was used to authenticate the current user of a computer.

Set objDomain = getObject("LDAP://rootDse")
objDC = objDomain.Get("dnsHostName")
Wscript.Echo objDC

This is a VB Script, this can be used by saving the file in .vbs file

Enumerating All Domain Controllers

Returns a list of all the domain controllers in the fabrikam.com domain.

Const ADS_SCOPE_SUBTREE = 2
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand = CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCOmmand.ActiveConnection = objConnection
 
objCommand.CommandText = _
    "Select distinguishedName from 'LDAP://cn=Configuration,DC=fabrikam,DC=com' " _
        & "where objectClass='nTDSDSA'" 
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Timeout") = 30 
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 
objCommand.Properties("Cache Results") = False 
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst
 
Do Until objRecordSet.EOF
    Wscript.Echo "Computer Name: " & objRecordSet.Fields("distinguishedName").Value
    objRecordSet.MoveNext
Loop

This is a VB Script, this can be used by saving the file in .vbs file

Determining if a Domain Controller is in a Site

Checks if a domain controller is in a specific Active Directory site

strDcName = "atl-dc-01"
strSiteName = "ga-atl-sales"
 
Set objADSysInfo = CreateObject("ADSystemInfo")
strDcSiteName = objADSysInfo.GetDCSiteName(strDcName)
 
If UCase(strSiteName) = UCase(strDcSiteName) Then
    WScript.Echo "TRUE: " & strDcName & " is in site " & strSiteName
Else
    WScript.Echo "FALSE: " & strDcName & " is NOT in site " & strSiteName
End If

This is a VB Script, this can be used by saving the file in .vbs file

Target account name is incorrect errors

Determine if replication is failing between domain controllers in different domains or the same domain. Review the directory service event logs very closely to identify what the source of the error is, such as a conflicting object.

I. If replication is failing between domain controllers in different domains:

1. Add the registry value below to the upstream replication partner.
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters
   Value name:  Replicator Allow SPN Fallback
   Value type:  REG_DWORD
   Value data:  1
   
2. Run the following command from the upstream partner: 
   repadmin /add CN=Configuration,DC=<Contoso>,DC=<com> <root DC name> <fully qualified name of child DC>
   
3. Remove the Replicator Allow SPN Fallback registry value after testing replication.

II. Search for duplicate computer or user accounts in the domain of the failing domain controller and its upstream replication partner. For more information see KB article 310340.

III. Review the server objects of the problematic domain controllers in Active Directory Sites and Services to make sure there are no duplicates or conflicting objects present.

IV. Verify that multiple server names with the same IP address are not registered in DNS, which can happen if a domain controller is renamed and old DNS records are not scavenged. Use Adsiedit or Ldp (both are included in the Windows 2000 Support Tools) to verify that the dNSHostName attribute on each domain controller is populated with the correct value. To do this, perform the following steps.

1. Type adsiedit.msc from Start, Run.
2. Expand the Domain NC container.
3. Expand the object below, i.e. DC=Contoso, DC=COM.
4. Expand OU=Domain Controllers.
5. Right-click CN=<domain_controller>, and select Properties.
6. Under Select a property to view, select dNSHostName and verify the value contains the fully qualified name of the server, i.e. dc1.contoso.com.

V. If the problem domain controllers exist in only one domain with more than two domain controllers, then force all computer accounts to be replicated throughout the enterprise. That means all domain controllers must be synchronized with all other copies of their domain. For each computer that is reporting a replication error, use the following command to force that computer to become synchronized. The domain to synchronize must be specified. For more information see KB article 296993.

repadmin /syncall /d /e <problem domain controller> <DN of domain>

Note For large environments, remove the /e switch to replicate domain controllers with the same site or use /sync to target specific domain controllers in remote sites.

VI. If the failing domain controllers reside in different domains, then specify the configuration partition. For more information see KB article 296993.

repadmin /syncall /d /e <problem domain controller> <DN of config>

Note For large environments remove the /e switch to replicate domain controllers with the same site or use /sync to target specific domain controllers in remote sites.

VII. If the problem exists between domain controllers from different domains, check the trust relationship by doing the following:

1. Open Active Directory Domains and Trusts.
2. Right-click the desired domain and select Properties.
3. Click the Trusts tab.
4. Highlight the domain to verify and click Edit.
5. Click Verify.

The Netdom tool, included in the Windows 2000 Support Tools, can also be used to verify the trust.

netdom trust <trusting_domain_name> /domain:<trusted_domain_name> /userd:<administrator> /password:<password> /verify /kerberos

VIII. If the error happens when attempting replication between two domain controllers in different domains that have a parent/child or tree root trust relationship, it may be the result of a missing object that represents the trust relationship between the two domains. This object is known as a trustedDomain object and is found in the System container in the Active Directory Users and Computers tool. This type of object directly relates to the trust relationships displayed in Active Directory Domains and Trusts. If this object is not present Active Directory, cross-domain authentication will fail. If you discover that the trustedDomain object is missing, refer to the “Missing trustedDomain object” section of the troubleshooter.

IX. Make sure the Service Principal Name (SPN) is registered for each domain controller object on each partner domain controller. For more information see KB article 308111.

Review the Registered Service Principal Names section of the Netdiag output on partner domain controllers to ensure that the test passes. Export the SPNs of each domain controller object involved in the replication failure from each partner using the following command:

ldifde -f spndump.txt -p base -l servicePrincipalName -d <DN of DC>

Either visually compare the SPNs or use the Windiff tool from the Windows 2000 Support Tools to compare the files for differences. Under the Options menu in Windiff, uncheck everything except Show different files, Show left-only lines, and Show right-only lines. Once you have identified the missing SPNs, edit the good SPN file with the following steps:

1. Change changetype:  add to changetype:  modify.
2. Add replace:  servicePrincipalName after the changetype line.
3. Add "-" to the last line of the file.

Import the correctly registered SPNs on the partner domain controllers that do not have proper SPNs registered for its replication partner domain controllers.

ldifde -I -f goodSPNs.txt

Performing a Cross-Domain Move of a Computer Object

Uses the MoveHere method in IADsContainer to move an object to another domain. Note that there are a number of restrictions associated with performing this type of move operation. For details, see the Directory Services Platform SDK.

Set objOU = GetObject("LDAP://cn=Computers,dc=NA,dc=fabrikam,dc=com")
objOU.MoveHere "LDAP://cn=Computer01,cn=Users,dc=fabrikam,dc=com", _
    vbNullString

This is a VB Script, this can be used by saving the file in .vbs file

Joining Computer to a Domain

Joins a computer to a domain and creates the computer's account in Active Directory.

Const JOIN_DOMAIN             = 1
Const ACCT_CREATE             = 2
Const ACCT_DELETE             = 4
Const WIN9X_UPGRADE           = 16
Const DOMAIN_JOIN_IF_JOINED   = 32
Const JOIN_UNSECURE           = 64
Const MACHINE_PASSWORD_PASSED = 128
Const DEFERRED_SPN_SET        = 256
Const INSTALL_INVOCATION      = 262144
 
strDomain   = "FABRIKAM"
strPassword = "ls4k5ywA"
strUser     = "shenalan"
 
Set objNetwork = CreateObject("WScript.Network")
strComputer = objNetwork.ComputerName
 
Set objComputer = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\" & _
    strComputer & "\root\cimv2:Win32_ComputerSystem.Name='" & _
        strComputer & "'")
 
ReturnValue = objComputer.JoinDomainOrWorkGroup(strDomain, _
                                                strPassword, _
                                                strDomain & "\" & strUser, _
                                                NULL, _
                                                JOIN_DOMAIN + ACCT_CREATE)

This is a VB Script, this can be used by saving the file in .vbs file

Identifying FSMO Roles

Identify which Active Directory domain controllers are providing the five FSMO roles: Schema Master, Domain Naming Master, PDC Emulator, RID Master, and Infrastructure Master.

Set objRootDSE = GetObject("LDAP://rootDSE")
 
' Schema Master
Set objSchema = GetObject("LDAP://" & objRootDSE.Get("schemaNamingContext"))
strSchemaMaster = objSchema.Get("fSMORoleOwner")
Set objNtds = GetObject("LDAP://" & strSchemaMaster)
Set objComputer = GetObject(objNtds.Parent)
WScript.Echo "Forest-wide Schema Master FSMO: " & objComputer.Name
 
Set objNtds = Nothing
Set objComputer = Nothing
 
' Domain Naming Master
Set objPartitions = GetObject("LDAP://CN=Partitions," & _
                              objRootDSE.Get("configurationNamingContext"))
strDomainNamingMaster = objPartitions.Get("fSMORoleOwner")
Set objNtds = GetObject("LDAP://" & strDomainNamingMaster)
Set objComputer = GetObject(objNtds.Parent)
WScript.Echo "Forest-wide Domain Naming Master FSMO: " & objComputer.Name
 
Set objNtds = Nothing
Set objComputer = Nothing
 
' PDC Emulator
Set objDomain = GetObject("LDAP://" & objRootDSE.Get("defaultNamingContext"))
strPdcEmulator = objDomain.Get("fSMORoleOwner")
Set objNtds = GetObject("LDAP://" & strPdcEmulator)
Set objComputer = GetObject(objNtds.Parent)
WScript.Echo "Domain's PDC Emulator FSMO: " & objComputer.Name
 
Set objNtds = Nothing
Set objComputer = Nothing
 
' RID Master
Set objRidManager = GetObject("LDAP://CN=RID Manager$,CN=System," & _
                              objRootDSE.Get("defaultNamingContext"))
strRidMaster = objRidManager.Get("fSMORoleOwner")
Set objNtds = GetObject("LDAP://" & strRidMaster)
Set objComputer = GetObject(objNtds.Parent)
WScript.Echo "Domain's RID Master FSMO: " & objComputer.Name
 
Set objNtds = Nothing
Set objComputer = Nothing
 
' Infrastructure Master
Set objInfrastructure = GetObject("LDAP://CN=Infrastructure," & _
                                  objRootDSE.Get("defaultNamingContext"))
strInfrastructureMaster = objInfrastructure.Get("fSMORoleOwner")
Set objNtds = GetObject("LDAP://" & strInfrastructureMaster)
Set objComputer = GetObject(objNtds.Parent)
WScript.Echo "Domain's Infrastructure Master FSMO: " & objComputer.Name

This is a VB Script, this can be used by saving the file in .vbs file