AD domain and forest functional levels
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit dc1820e · +37 −79 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.topic: how-to
55
ms.author: wscontent
66
author: gswashington
7
−ms.date: 09/25/2024
7
+ms.date: 09/26/2024
88
---
99
# Raise domain and forest functional levels in Active Directory Domain Services
1010
⋯ 2 unchanged lines
1313
> [!IMPORTANT]
1414
> Windows Server 2025 is in PREVIEW. This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
1515
16
−This article describes how to raise Active Directory domain and forest functional levels in Microsoft Windows Server domain controllers. Functional levels determine the available Active Directory Domain Services (AD DS) domain or forest capabilities. They also determine which Windows Server operating systems you can run on domain controllers in the domain or forest. Level changes happen when you use later versions of your domain controller operating system, the domain, or your forest functional level.
17
−
18
−Functional levels are an extension of the mixed mode and native mode concepts in Windows Server that activate Active Directory features. Active Directory features become available when all domain controllers run the latest version of Windows Server in a domain or forest and the administrator activates the corresponding functional level.
16
+Functional levels determine the available Active Directory Domain Services (AD DS) domain or forest capabilities. They also determine which Windows Server operating systems you can run on domain controllers in the domain or forest. Level changes happen when you use later versions of your domain controller operating system, the domain, or your forest functional level. This article describes how to raise Active Directory domain and forest functional levels in Microsoft Windows Server domain controllers. We recommend you upgrade Active Directory and Active Directory Lightweight Directory Services servers to the latest release.
1917
2018
To activate the latest domain features, all domain controllers in the domain must run the latest version of Windows Server. If they don't meet this requirement, the administrator can't raise the domain functional level.
2119
⋯ 10 unchanged lines
3230
3331
- All domain controllers in the domain are running at least the version of Windows Server that you want to raise the domain functional level to. For example, to raise the domain functional level to Windows Server 2025, all domain controllers in the domain must be running Windows Server 2025. If you have domain controllers running earlier versions of Windows Server, you must upgrade them to Windows Server 2025 before you can raise the domain functional level.
3432
35
−- Before you can promote a machine running Windows Server 2025 to a domain controller in an existing domain, that domain must also be at least at the Windows Server 2016 functional level. For newly created Active Directory forests under Windows Server 2025, the minimum functional level is Windows Server 2016.
33
+- Before you can promote a machine running Windows Server 2025 to a domain controller in an existing domain, that domain must also be at least at the Windows Server 2016 functional level. For newly created Active Directory forests under Windows Server 2025, the minimum functional level is Windows Server 2016. Earlier versions of Windows Server don't support Windows Server 2025 domain controllers.
3634
3735
- Your Active Directory forest and domain is operational and free from replication errors. To learn more about replication errors, see [Diagnose Active Directory replication failures](/troubleshoot/windows-server/active-directory/diagnose-replication-failures).
3836
⋯ 1 unchanged line
4038
4139
- You must be a member of the Enterprise Admins group or equivalent to raise the forest functional level.
4240
43
−> [!NOTE]
44
−> Before you can promote a machine running Windows Server 2025 to a domain controller in an existing domain, that domain must also be at least at the Windows Server 2016 functional level.
45
−
46
−## View the current functional level
47
−
48
−You can use Lightweight Directory Access Protocol (LDAP) tools such as _Ldp.exe_ and _Adsiedit.msc_ to view the current domain and forest functional level settings. The most common method to upgrade the domain and forest functional levels is to use the Active Directory Domains and Trusts console, found in the Remote Server Administration Tools (RSAT). You can either configure the functional level using the console or use PowerShell cmdlets. For more information about how to use Windows PowerShell to configure the functional level, see [Set-ADDomainMode](/powershell/module/activedirectory/set-adforestmode) and [Set-ADDomainMode](/powershell/module/activedirectory/set-addomainmode).
49
−
50
−We recommend you upgrade Active Directory and Active Directory Lightweight Directory Services servers to the latest release.
51
−
52
−> [!IMPORTANT]
53
−> Before you can promote a machine running Windows Server 2025 to a domain controller, you must make sure all domain controllers in the existing domain are running Windows Server 2016 or later. Earlier versions of Windows Server don't support Windows Server 2025 domain controllers.
54
−>
55
−> When you install Active Directory Domain Services on Windows Server 2025 (preview), it automatically runs _adprep_ on any forest or domain running earlier versions of Windows Server.
56
−
57
−### Domain functional level
58
−
59
−To view the current domain functional level, use _ADSI Edit_ to view the current `msDS-Behavior-Version` attribute for the domain.
60
−
61
−1. Sign in to a domain controller.
62
−
63
−1. Select the Start menu, then enter _ADSI Edit_ in the search box.
64
−
65
−1. Open the **ADSI Edit** app.
66
−
67
−1. In the navigation plane, right-click **ADSI Edit**, and then select **Connect to**.
68
−
69
−1. In the **Connection Settings** dialog box, select **OK** to using the defaults to connect to the Default naming context for the current domain.
70
−
71
−1. Expand the **Default naming context** node then right-click the domain node, and then select **Properties**.
72
−
73
−1. In the **Properties** dialog box, locate the **msDS-Behavior-Version** attribute. This attribute contains the current domain functional level.
74
−
75
−The `msDS-Behavior-Version` attribute represents the highest possible functional level for this domain controller. The values for this attribute are:
76
−
77
−- Windows Server 2000: `0` or `Windows2000Domain`
78
−
79
−- Windows Server 2003 Interim Domain: `1` or `Windows2003InterimDomain`
80
−
81
−- Windows Server 2003: `2` or `Windows2003Domain`
82
−
83
−- Windows Server 2008: `3` or `Windows2008Domain`
84
−
85
−- Windows Server 2008 R2: `4` or `Windows2008R2Domain`
86
−
87
−- Windows Server 2012: `5` or `Windows2012Domain`
88
−
89
−- Windows Server 2012 R2: `6` or `Windows2012R2Domain`
41
+- You must have a computer with either of the following Remote Server Administration Tools (RSAT) installed:
9042
91
−- Windows Server 2016: `7` or `WinThreshold`
43
+ - AD DS Tools.
9244
93
−- Windows Server 2025: `10` or `Windows2025Domain`
45
+ OR
9446
95
−### Mixed mode and native mode
47
+ - Active Directory module for Windows PowerShell.
9648
97
−The `ntMixedDomain` attribute, also located in the default naming context properties, shows the domain mode.
49
+> [!NOTE]
50
+> Before you can promote a machine running Windows Server 2025 to a domain controller in an existing domain, that domain must also be at least at the Windows Server 2016 functional level.
9851
99
−The following are the values for this attribute:
52
+## View the current functional level
10053
101
−- `0` = Native level domain
54
+To view the current domain and forest functional levels, you can use the Active Directory Domains and Trusts console or Windows PowerShell. The following sections describe how to raise the functional levels using these methods.
10255
103
−- `1` = Mixed level domain
56
+> [!NOTE]
57
+> Windows Server 2019 and Windows Server 2022 use Windows Server 2016 as the most recent functional levels.
10458
105
−### Forest level
59
+### [Desktop](#tab/desktop)
10660
107
−To view the current forest functional level, use _ADSI Edit_ to view the current `msDS-Behavior-Version` attribute for the forest. Follow the steps to view the `msDS-Behavior-Version` attribute in the CN=Partitions object found in the Configuration naming context (NC).
61
+To raise the domain or forest functional level using the Active Directory Domains and Trusts console, follow these steps.
10862
109
−1. From ADSI Edit, right-click the **ADSI Edit** node, and then select **Connect to**.
63
+1. Sign on to a computer with the AD DS Remote Server Administration Tools (RSAT) installed.
11064
111
−1. In the **Connection Settings** dialog box, select **Configuration** from the **Select a well known Naming Context**, then select **OK**.
65
+1. Select the Start menu, then enter _Active Directory Domains and Trusts_ in the search box.
11266
113
−1. Expand the **Configuration** node, then the configuration container. The container is in the form of `CN=Configuration,DC=<domain name>,DC=<top level domain>`.
67
+1. Open the **Active Directory Domains and Trusts** app.
11468
115
−1. Right-click the **CN=Partitions** container, and then select **Properties**.
69
+1. In the console tree, right-click the domain node, and then select **Properties**.
11670
117
−1. In the **Properties** dialog box, locate the **msDS-Behavior-Version** attribute. This attribute contains the current forest functional level.
71
+1. The **Properties** dialog box shows the current domain and forest functional level.
11872
119
−The `msDS-Behavior-Version` attribute represents the highest possible functional level for this forest. The values for this attribut eare:
73
+### [PowerShell](#tab/PowerShell)
12074
121
−- Windows Server 2000: `0` or `Windows2000Forest`
75
+To view the domain or forest functional level using PowerShell, follow these steps.
12276
123
−- Windows Server 2003 Interim Forest: `1` or `Windows2003InterimForest`
77
+1. Sign on to a computer with the AD DS Remote Server Administration Tools (RSAT) installed.
12478
125
−- Windows Server 2003: `2` or `Windows2003Forest`
79
+1. Open PowerShell as an administrator.
12680
127
−- Windows Server 2008: `3` or `Windows2008Forest`
81
+1. Run the following command to view the current domain functional level, replacing `<domain>` with the domain name.
12882
129
−- Windows Server 2008 R2: `4` or `Windows2008R2Forest`
83
+ ```powershell
84
+ Get-ADDomain -Identity <domain> | Select-Object DomainMode
85
+ ```
13086
131
−- Windows Server 2012: `5` or `Windows2012Forest`
87
+1. Run the following command to view the current forest functional level, replacing `<forest>` with the forest name.
13288
133
−- Windows Server 2012 R2: `6` or `Windows2012R2Forest`
89
+ ```powershell
90
+ Get-ADForest -Identity <forest> | Select-Object ForestMode
91
+ ```
13492
135
−- Windows Server 2016: `7` or `WinThreshold`
93
+For more information about the `Get-ADDomain` and `Get-ADForest` cmdlets, see [Get-ADDomain](/powershell/module/activedirectory/get-addomain) and [Get-ADForest](/powershell/module/activedirectory/get-adforest).
13694
137
−- Windows Server 2025: `10` or `Windows2025Forest`
95
+---
13896
13997
## Raise the functional level
14098
⋯ 6 unchanged lines
147105
148106
To raise the domain or forest functional level using the Active Directory Domains and Trusts console, follow these steps.
149107
150
−1. Sign in to a domain controller.
108
+1. Sign on to a computer with the AD DS Remote Server Administration Tools (RSAT) installed.
151109
152110
1. Select the Start menu, then enter _Active Directory Domains and Trusts_ in the search box.
153111
⋯ 15 unchanged lines
169127
170128
To raise the domain or forest functional level using PowerShell, follow these steps.
171129
172
−1. Sign in to a domain controller.
130
+1. Sign on to a computer with the AD DS Remote Server Administration Tools (RSAT) installed.
173131
174132
1. Open PowerShell as an administrator.
175133
⋯ 13 unchanged lines
189147
190148
1. To confirm the change, select **Y**.
191149
192
−You've now raised the domain and forest functional level.
150
+You've now raised the domain and forest functional level. For more information about the `Set-ADDomainMode` and `Set-ADForestMode` cmdlets, see [Set-ADDomainMode](/powershell/module/activedirectory/set-addomainmode) and [Set-ADForestMode](/powershell/module/activedirectory/set-adforestmode).
193151
194152
---
195153
⋯ 5 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 02:30 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.