How to Raise Active Directory Domain and Forest Functional Level?

The functional level of the Active Directory domain and forest determines the available features that can be used in the domain, and the Windows Server version you can use on domain controllers.

For example, if you have Windows Server 2016 domain controllers, and the domain functional level is only Windows Server 2003, you won’t be able to use the Active Directory Recycle Bin (introduced in the AD version in Windows Server 2008 R2). In this article, we’ll show you how to raise your Active Directory domain and forest functional level from Windows Server 2012 R2 to Windows Server 2016.

How to Check the Domain and Forest Functional Levels?

You can check the current domain and forest functional level using the Active Directory Domains and Trusts mmc snap-in (domain.msc). Open your domain properties. Domain and forest functional levels are listed on the General tab. In our case, this is Windows Server 2012 R2.

raise forest functional level

You can display the current domain functional level using PowerShell:

Get-ADDomain | fl Name, DomainMode

Windows2012R2Domain

Now let’s check the forest functional level:

Get-ADForest | fl Name, ForestMode

Windows2012R2Forest

raise domain functional level

How to Raise Active Directory Domain and Forest Functional Levels?

Before raising the domain and forest functional level, you need to upgrade the Windows Server version on all domain controllers to Windows Server 2016. You can use an in-place upgrade (not recommended), or install additional domain controllers with Windows Server 2016, and correctly remove legacy DC versions from your Active Directory environment.

READ ALSO  Using ldapsearch to Query Active Directory Objects

Hint. When you upgrade the domain functional level from Windows Server 2003 to a newer version, the password for the krbtgt account will be forcibly reset. This can affect the availability of Exchange services. Also, remember to migrate AD replication in the domain from FRS to Distributed File Service (DFS) replication.

To raise the functional level of a domain, you can run the mmc snap-in Active Directory Domains and Trusts. Right click on the domain name, and select Raise Domain Functional Level.

change forest functional level

In the window that opens, select the functional level Windows Server 2016, and click the Raise button.

check forest functional level

Before you can raise the forest functional level, all domains in the forest must be upgraded to the same or a higher domain functional level. To raise the functional level of a forest, you must be a member of the Enterprise Admins group. The Active Directory Domains and Trusts snap-in is also used to raise the functional level of the forest.

Right click on the root of the snap-in, and select Raise Forest Functional Level.

In the next windows, select the required functional forest level, and click the Raise button

Important! The domain and AD forest functional level upgrade cannot be reversed.

You can also raise the domain functional level using PowerShell. The following command is used:

Set-ADDomainMode -identity theitbros.com -DomainMode Windows2016Domain

Wait for AD replication to complete and verify that all domain controllers report the domain functional level is now Windows2016Domain.

READ ALSO  How to Seize FSMO Roles From Dead Domain Controller?

To raise the functional level of the forest, another command is used:

Set-ADForestMode -Identity theitbros.com -ForestMode Windows2016Domain
Cyril Kardashevsky

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.