How to fix Error 1354 on Windows 11

by

Troubleshooting Guide: Error 1354 – “This Operation Is Only Allowed for the Primary Domain Controller of the Domain”

Why This Error Happens

This error occurs when an administrative tool or script attempts to perform an operation—such as modifying FSMO roles, editing certain domain policies, or running directory service commands—on a Domain Controller that is not currently holding the PDC Emulator role. Active Directory restricts specific write operations exclusively to the PDC Emulator to maintain consistency across the domain. This mismatch often happens after a role transfer, seizure, or when an administrator unknowingly targets a secondary DC via Server Manager, PowerShell, or netdom/ntdsutil commands.

Step-by-Step Resolution Guide

Step 1: Identify the Current PDC Emulator Holder

  • Open PowerShell as Administrator on your Windows 11 management machine (with RSAT installed).
  • Run the command: netdom query fsmo
  • Note which Domain Controller is listed next to “PDC Emulator Owner.”

Step 2: Redirect Your Administrative Action to the Correct DC

  • Instead of running the operation locally or on the wrong server, connect directly to the identified PDC Emulator.
  • In “Active Directory Users and Computers” (dsa.msc), right-click the domain root, select “Change Domain Controller,” and choose the PDC Emulator explicitly.
  • If using PowerShell, add the -Server parameter, for example: Set-ADDefaultDomainPasswordPolicy -Server "PDC-Hostname.domain.com"

Step 3: Transfer the FSMO Role (If the Current PDC is Unreachable)

  • If the original PDC Emulator is offline or decommissioned, transfer the role properly using ntdsutil.
  • Open Command Prompt as Administrator and type: ntdsutil
  • Enter roles, then connections, then connect to server <TargetDC-Name>, followed by quit.
  • Finally, type transfer PDC to move the role to the currently connected, healthy DC.

Step 4: Verify Domain Controller Health and Replication

  • Check the System and Directory Service event logs (Event Viewer) on the target DC for replication errors that might block role recognition.
  • Run repadmin /replsummary to ensure Active Directory replication is functioning correctly between DCs before retrying the operation.

Alternative or Verification Steps

  • After re-attempting the action on the correct PDC Emulator, re-run netdom query fsmo to confirm the role assignment sticks and matches the server you targeted.
  • If the PDC Emulator is permanently lost and cannot be transferred gracefully, use ntdsutil to seize (rather than transfer) the PDC role on a healthy DC, but only after confirming the original DC will never rejoin the network to avoid a duplicate role conflict (USN rollback).