Hi I have this error on all site (master and slave):
Access forbidden! Only the website where the data is physically stored can manage the users permissions

How do I enable even just the master site?

This error message mean that you are trying to manage the "Multisites Users" from a slave site that is under the control of the "Multisites Users".
This extension should never have to be installed in a slave that is under the control of the "Multisites Users" or this would be a security vulnerability that would let a slave grant its access.

You need to access the website where you installed the "Multisites Users" for the first time.
A way to retreive the name of the physcial website is to go in the JMS Tools menu and in the table tabs to put the cursor over the #__multisites_users is probably a link contain the reference to the "parent" website or physical website.
When you have retrieved this physical location, you will be able to know the website where you have physically installed the #__multisites_users table.

If you want to bypass this security rule, you can modify the rule present in the /administrator/components/com_multisitesusersite/multisitesusersite.cfg.php
and put FALSE as below

define( 'MULTISITESUSERSITE_CFG_RESTRICT_ON_TABLE', false);

I have mouse over the #__multisites_users and it shows the master site location.

However my master still shows:
Access forbidden! Only the website where the data is physically stored can manage the users permissions

I have also realized that whenever I create a user from master site, it wont appear in user manager but it is in the database.

I have realised that multisite have identified one of the slave site as master site.
May I know how do i change it?

The master website is displayed when the domain is NOT defined in the JMS "Master index".

The "Master index" is built (refreshed) when you save a slave site definition.
If you have an error while saving the slave site then ALL the domains of all the slave sites defined are NOT updated inside the master index (it is not rebuilt).

So if you have the master website that is displayed, this mean that the URL (domain, subdomain, subdirectory) is not defined in any slave site OR that you had an error while saving the slave site definition.

Remark: you have to declare the domains with both WWW and without www.
If you want http and https, you also have to define them both.

For example

www.jms2win.com
jms2win.com
www.jms2win.com
jms2win.com

Where can I find JMS "Master index"?