Raise Active Directory Domain and Forest Functional Levels using PowerShell
Updated: Jan 16th, 2015 – 8:10am MT – Fixed typo in Set-ADForestMode section.
In this easy Ask the Admin, I’ll show you how to determine and change the domain and forest functional levels in Active Directory (AD).
The domain and forest functional levels indicate that all domain controllers (DCs) are running a specific version of Windows Server, and that domain or forest-wide features only supported in that version of Windows Server can be enabled in the domain(s) and/or forest.
Before raising the functional level of a domain, all DCs in the domain must be running the same version of Windows Server. For instance, before changing the domain functional level to Windows Server 2012 R2, all DCs in the domain must be running Windows Server 2012 R2. When configuring a new AD domain, it’s always best to set the domain functional level to the highest possible level if you’re not planning to join any DCs running legacy versions of Windows Server.
Determine the Domain and Forest Functional Levels
The easiest way to find the functional level of a domain is using Windows PowerShell. You can run the following commands from a domain controller or any domain-joined PC with the PowerShell module for Active Directory installed.
Piping the results of Get-ADDomain to select is not compulsory, but reduces down the amount of information returned. When no parameters are specified for the Get-ADDomain cmdlet as shown above, information about the current user's domain is returned. If you want to retrieve information about a specific domain, then you must specify it as shown below:
The -identity parameter can be populated with a domain name given using DNS, distinguished name (DC=ad,DC=contoso,DC=com), objectGUID, NetBIOS name or Security Identifier (SID).
Raise the Domain Functional LevelOnce all the domain controllers in a domain are running the same version of Windows Server, you might decide to raise the domain functional level to get access to features that are exclusive to a particular domain functional level. The most important point to remember is that it's not possible to roll back this operation, so make sure you have tested thoroughly before committing. You must be a member of the Domain Admins group to raise the domain functional level, and you'll need to replace ad.contoso.com with the Fully Qualified Domain Name (FQDN) of your AD domain.
In the example above, I'm raising the domain functional level to Windows Server 2012 R2, because all the DCs in my domain now run that version of Windows Server, but other possible values for the –DomainMode parameter are:
Raise the Forest Functional LevelWhen all the domains in a forest are set to the same functional level, you can then raise the forest functional level. The supported forest modes are:
Don't forget, that with a few exceptions, it's not possible to roll back this operation.
More in Active Directory
Microsoft Launches New On-Premises Unified Update Platform To Manage Windows Updates
Jul 27, 2022 | Rabia Noureen
How to Fix The "Trust Relationship Between This Workstation And The Primary Domain Failed" Error
Jul 27, 2022 | Michael Reinders
iCloud for Windows Now Lets Users Generate 2FA Codes
Jul 26, 2022 | Rabia Noureen
Windows 12 Won't Be a Big Bang Release. Here's Why.
Jul 22, 2022 | Russell Smith
How to Install Active Directory PowerShell Module
Jul 18, 2022 | Michael Reinders
CISA Advises Federal Agencies to Patch Windows LSA Flaw Affecting Domain Controllers
Jul 5, 2022 | Rabia Noureen
Most popular on petri