Raise Active Directory Domain and Forest Functional Levels using PowerShell
Updated: Jan 16th, 2015 – 8:10am MT – Fixed typo in Set-ADForestMode section.
In this easy Ask the Admin, I’ll show you how to determine and change the domain and forest functional levels in Active Directory (AD).
The domain and forest functional levels indicate that all domain controllers (DCs) are running a specific version of Windows Server, and that domain or forest-wide features only supported in that version of Windows Server can be enabled in the domain(s) and/or forest.
Before raising the functional level of a domain, all DCs in the domain must be running the same version of Windows Server. For instance, before changing the domain functional level to Windows Server 2012 R2, all DCs in the domain must be running Windows Server 2012 R2. When configuring a new AD domain, it’s always best to set the domain functional level to the highest possible level if you’re not planning to join any DCs running legacy versions of Windows Server.
Say Goodbye to Traditional PC Lifecycle Management
Traditional IT tools, including Microsoft SCCM, Ghost Solution Suite, and KACE, often require considerable custom configurations by T3 technicians (an expensive and often elusive IT resource) to enable management of a hybrid onsite + remote workforce. In many cases, even with the best resources, organizations are finding that these on-premise tools simply cannot support remote endpoints consistently and reliably due to infrastructure limitations.
Determine the Domain and Forest Functional Levels
The easiest way to find the functional level of a domain is using Windows PowerShell. You can run the following commands from a domain controller or any domain-joined PC with the PowerShell module for Active Directory installed.
Piping the results of Get-ADDomain to select is not compulsory, but reduces down the amount of information returned. When no parameters are specified for the Get-ADDomain cmdlet as shown above, information about the current user's domain is returned. If you want to retrieve information about a specific domain, then you must specify it as shown below:
The -identity parameter can be populated with a domain name given using DNS, distinguished name (DC=ad,DC=contoso,DC=com), objectGUID, NetBIOS name or Security Identifier (SID).
Raise the Domain Functional LevelOnce all the domain controllers in a domain are running the same version of Windows Server, you might decide to raise the domain functional level to get access to features that are exclusive to a particular domain functional level. The most important point to remember is that it's not possible to roll back this operation, so make sure you have tested thoroughly before committing. You must be a member of the Domain Admins group to raise the domain functional level, and you'll need to replace ad.contoso.com with the Fully Qualified Domain Name (FQDN) of your AD domain.
In the example above, I'm raising the domain functional level to Windows Server 2012 R2, because all the DCs in my domain now run that version of Windows Server, but other possible values for the –DomainMode parameter are:
Raise the Forest Functional LevelWhen all the domains in a forest are set to the same functional level, you can then raise the forest functional level. The supported forest modes are:
Don't forget, that with a few exceptions, it's not possible to roll back this operation.