is allocated a pool of RIDs that it is allowed to assign to the security principals it creates. When a DC's allocated RID pool falls below a threshold, that DC issues a request for additional RIDs to the domain's RID Master FSMO role owner, the RID Master FSMO role owner responds to the request by retrieving RIDs from the domain's unallocated RID pool and assigns them to the pool of the requesting DC. The Infrastructure Master - The purpose of this role is to ensure that cross-domain object references are correctly handled. For example, if a user from one domain is added to a security group from a different domain, the Infrastructure Master makes sure this is done properly. However, if the Active Directory deployment has only a single domain, then the Infrastructure Master role does no work at all, and even in a multi-domain environment it is rarely used except when complex user administration tasks are performed. This applies to the domain partition (default naming context) only. and will only query the domain partition. However, every application partition, including Forest and Domain-level DNS domain zones has its own Infrastructure Master. The holder of this role is stored in the attribute of the object in the root of the partition, it can be modified with , for example one can modify the attribute of the object to . Per-forest roles These roles are unique at the forest level (both are located in the forest root domain): The Schema Master - The purpose of this role is to replicate schema changes to all other domain controllers in the forest. Since the schema of Active Directory is rarely changed, however, the Schema Master role will rarely do any work. This role is typically involved in the deployment of Exchange Server and Skype for Business Server, as well as domain controllers from one version to another version, as all of these situations involve making changes to the Active Directory schema. The Domain Naming Master - The other forest-specific FSMO role is the Domain Naming Master, and this role also resides in the forest root domain. The Domain Naming Master role processes all changes to the namespace, for example adding the child domain vancouver.mycompany.com to the forest root domain mycompany.com requires that this role be available. Failure of this role to function correctly can prevent the addition of a new child domain or new