Raise Active Directory Domain and Forest Functional Levels using PowerShell
Updated: Jan 16th, 2015 – 8:10am MT – Fixed typo in Set-ADForestMode section.
In this easy Ask the Admin, I’ll show you how to determine and change the domain and forest functional levels in Active Directory (AD).
The domain and forest functional levels indicate that all domain controllers (DCs) are running a specific version of Windows Server, and that domain or forest-wide features only supported in that version of Windows Server can be enabled in the domain(s) and/or forest.
Before raising the functional level of a domain, all DCs in the domain must be running the same version of Windows Server. For instance, before changing the domain functional level to Windows Server 2012 R2, all DCs in the domain must be running Windows Server 2012 R2. When configuring a new AD domain, it’s always best to set the domain functional level to the highest possible level if you’re not planning to join any DCs running legacy versions of Windows Server.
Determine the Domain and Forest Functional Levels
The easiest way to find the functional level of a domain is using Windows PowerShell. You can run the following commands from a domain controller or any domain-joined PC with the PowerShell module for Active Directory installed.
Piping the results of Get-ADDomain to select is not compulsory, but reduces down the amount of information returned. When no parameters are specified for the Get-ADDomain cmdlet as shown above, information about the current user's domain is returned. If you want to retrieve information about a specific domain, then you must specify it as shown below:
The -identity parameter can be populated with a domain name given using DNS, distinguished name (DC=ad,DC=contoso,DC=com), objectGUID, NetBIOS name or Security Identifier (SID).
Raise the Domain Functional LevelOnce all the domain controllers in a domain are running the same version of Windows Server, you might decide to raise the domain functional level to get access to features that are exclusive to a particular domain functional level. The most important point to remember is that it's not possible to roll back this operation, so make sure you have tested thoroughly before committing. You must be a member of the Domain Admins group to raise the domain functional level, and you'll need to replace ad.contoso.com with the Fully Qualified Domain Name (FQDN) of your AD domain.
In the example above, I'm raising the domain functional level to Windows Server 2012 R2, because all the DCs in my domain now run that version of Windows Server, but other possible values for the –DomainMode parameter are:
Raise the Forest Functional LevelWhen all the domains in a forest are set to the same functional level, you can then raise the forest functional level. The supported forest modes are:
Don't forget, that with a few exceptions, it's not possible to roll back this operation.
More in Active Directory
Google Workspace Introduces Passkey Support to Protect Users Against Phishing Attacks
Jun 7, 2023 | Rabia Noureen
Microsoft Releases Cross-Tenant Synchronization for Seamless Azure AD B2B Collaboration
May 31, 2023 | Rabia Noureen
Nvidia Announces New Hardware and Services for Enterprise AI at Computex
May 30, 2023 | Laurent Giret
Microsoft Lets IT Admins Remove Internet Explorer References From Windows 10
May 19, 2023 | Rabia Noureen
Managing Group Policy Objects: Create GPOs, Link GPOs, and Edit GPOs
Apr 28, 2023 | Michael Reinders
What is Group Policy?
Apr 27, 2023 | Michael Reinders
Most popular on petri