Microsoft's edit · AD domain and forest functional levels

11 ---

22 title: How to raise Active Directory domain and forest functional levels

33 description: Learn how to raise Active Directory domain and forest functional levels

4 −ms.topic: troubleshooting

4 +ms.topic: how-to

55 ms.author: robinharwood

66 author: gswashington

7 −ms.date: 05/15/2024

7 +ms.date: 09/19/2024

88 ---

99 # How to raise Active Directory domain and forest functional levels

1010

1111 >Applies to: Windows Server 2025 (preview), Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012

1212

13 −This article describes how to raise Active Directory domain and forest functional levels in Microsoft Windows Server domain controllers. Functional levels are the release of Active Directory that your domain controller operating system uses. Level changes happen when you use later or earlier versions of your domain controller operating system, the domain, or your forest functional level.

13 +> [!IMPORTANT]

14 +> Windows Server 2025 is in PREVIEW. This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.

1415

16 +This article describes how to raise Active Directory domain and forest functional levels in Microsoft Windows Server domain controllers. Functional levels determine the available Active Directory Domain Services (AD DS) domain or forest capabilities. They also determine which Windows Server operating systems you can run on domain controllers in the domain or forest. Level changes happen when you use later versions of your domain controller operating system, the domain, or your forest functional level.

17 +

1518 Functional levels are an extension of the mixed mode and native mode concepts in Windows Server that activate Active Directory features. Active Directory features become available when all domain controllers run the latest version of Windows Server in a domain or forest and the administrator activates the corresponding functional level.

1619

17 −To activate the latest domain features, all domain controllers in the domain must run the latest version of Windows Server. If they don't meet this requirement, the administrator can raise the domain functional level.

20 +To activate the latest domain features, all domain controllers in the domain must run the latest version of Windows Server. If they don't meet this requirement, the administrator can't raise the domain functional level.

1821

1922 To activate the latest forest-wide features, all domain controllers in the forest must run the Windows Server operating system version that matches the desired forest functional level. The current domain functional level must also already be at the latest level. If the forest meets these requirements, the administrator can raise the forest functional level.

2023

21 −Changes to the domain and forest functional levels are usually irreversible. In order to undo the change, you must use a forest recovery to revert to an earlier version of your forest. You can find a more detailed look at rollback scenarios when you need to undo changes to a domain or forest functional level in [Active Directory functional levels](/previous-versions/windows/it-pro/windows-server-2003/cc787290(v=ws.10)).

24 +> [!WARNING]

25 +> Changes to the domain and forest functional levels are irreversible. In order to undo the change, you must perform a forest recovery to revert to an earlier point of time.

2226

23 −> [!NOTE]

24 −> The latest domain and forest functional levels only affect how the domain controllers operate together as a group. The clients that interact with the domain or with the forest are unaffected by the changes. Applications are also unaffected by these changes. However, applications can use new features they can access in later versions of Windows Server once the administrator raises the domain level.For more information, see [Features associated with the various functional levels](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771294(v=ws.11)).

27 +The domain and forest functional levels only affect how the domain controllers operate together as a group. The clients that interact with the domain or with the forest are unaffected by the changes. Applications are also unaffected by these changes. However, applications can use new features found in later versions of Windows Server once the administrator raises the domain level. For more information about the functional levels, see [Active Directory Domain Services functional levels](/windows-server/identity/ad-ds/active-directory-functional-levels).

2528

2629 ## Prerequisites

2730

28 −You need the following things to raise the domain functional level in Windows Server 2016:

31 +You need to complete the following things to raise the domain functional level in Windows Server:

2932

30 −- Promoting an Active Directory or Active Directory Lightweight Directory Services replica requires that the existing domain or config set is already running with a functional level of Windows Server 2016 or greater.

33 +- All domain controllers in the domain are running at least the version of Windows Server that you want to raise the domain functional level to. For example, to raise the domain functional level to Windows Server 2025, all domain controllers in the domain must be running Windows Server 2025. If you have domain controllers running earlier versions of Windows Server, you must upgrade them to Windows Server 2025 before you can raise the domain functional level.

3134

32 −- For newly created Active Directory forests under Windows Server 2025 (preview), you must set the minimum functional level to Windows Server 2016.

35 +- Before you can promote a machine running Windows Server 2025 to a domain controller in an existing domain, that domain must also be at least at the Windows Server 2016 functional level. For newly created Active Directory forests under Windows Server 2025, the minimum functional level is Windows Server 2016.

3336

37 +- Your Active Directory forest and domain is operational and free from replication errors. To learn more about replication errors, see [Diagnose Active Directory replication failures](/troubleshoot/windows-server/active-directory/diagnose-replication-failures).

38 +

39 +- Identify all your DCs hosting the Global Catalog (GC) and FSMO roles. Create and verify backups of these Active Directory Domain Services domain controllers before making changes.

40 +

41 +- You must be a member of the Enterprise Admins group or equivalent to raise the forest functional level.

42 +

3443 > [!NOTE]

35 −> If you're promoting Windows Server 2025 (preview) to a domain controller in an existing domain, that domain must also be at least at the Windows Server 2016 functional level.

44 +> Before you can promote a machine running Windows Server 2025 to a domain controller in an existing domain, that domain must also be at least at the Windows Server 2016 functional level.

3645

37 −### Upgrade options

46 +## View the current functional level

3847

39 −We recommend you upgrade Active Directory and Active Directory Lightweight Directory Services servers to Windows Server 2022 to prepare for the Windows Server 2025 (preview) release. When setting up a new domain function level and forest function level for a new forest and domain, specify these levels when promoting a server to a domain controller.

48 +You can use Lightweight Directory Access Protocol (LDAP) tools such as _Ldp.exe_ and _Adsiedit.msc_ to view the current domain and forest functional level settings. The most common method to upgrade the domain and forest functional levels is to use the Active Directory Domains and Trusts console, found in the Remote Server Administration Tools (RSAT). You can either configure the functional level using the console or use PowerShell cmdlets. For more information about how to manually configure the functional level, see [View and set the functional level manually](#view-and-set-the-functional-level-manually). For more information about how to use Windows PowerShell to configure the functional level, see [Set-ADDomainMode](/powershell/module/activedirectory/set-adforestmode) and [Set-ADDomainMode](/powershell/module/activedirectory/set-addomainmode).

4049

41 −> [!NOTE]

50 +We recommend you upgrade Active Directory and Active Directory Lightweight Directory Services servers to the latest release.

51 +

52 +> [!IMPORTANT]

4253 > Before you can promote a machine running Windows Server 2025 to a domain controller, you must make sure all domain controllers in the existing domain are running Windows Server 2016 or later. Earlier versions of Windows Server don't support Windows Server 2025 domain controllers.

54 +>

55 +> When you install Active Directory Domain Services on Windows Server 2025 (preview), it automatically runs _adprep_ on any forest or domain running earlier versions of Windows Server.

4356

44 −When you install Active Directory Domain Services on Windows Server 2025 (preview), it automatically runs adprep on any forest or domain running earlier versions of Windows Server.

57 +### Domain functional level

4558

46 −> [!NOTE]

47 −> Improved algorithms for Name/Sid Lookups in Windows Server 2025 (preview) no longer use the legacy Netlogon secure channel and instead use Kerberos authentication and the DC Locator algorithm.

59 +To view the current domain functional level, use _ADSI Edit_ to view the current `msDS-Behavior-Version` attribute for the domain.

4860

49 −The most common method to enable the domain and forest functional levels is to use the graphical user interface (GUI) administration tools. You can learn more about how the GUI tools work at [Windows Server Active Directory functional levels](/previous-versions/windows/it-pro/windows-server-2003/cc759280(v=ws.10)). You can either manually configure the functional level or use PowerShell cmdlets. For more information about how to manually configure the functional level, see [View and set the functional level manually](#view-and-set-the-functional-level-manually). For more information about how to use Windows PowerShell script to configure the functional level, view [Raise the Forest Functional Level](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc730985(v=ws.11)).

61 +1. Sign in to a domain controller.

5062

51 −### View and set the functional level manually

63 +1. Select the Start menu, then enter _ADSI Edit_ in the search box.

5264

53 −You can use Lightweight Directory Access Protocol (LDAP) tools such as Ldp.exe and Adsiedit.msc to view and modify the current domain and forest functional level settings. When you change the functional level attributes manually, you should make attribute changes on the Flexible Single Master Operations (FSMO) domain controller that's targeted by the Microsoft administrative tools.

65 +1. Open the **ADSI Edit** app.

5466

55 −#### Domain functional level settings

67 +1. In the navigation plane, right-click **ADSI Edit**, and then select **Connect to**.

5668

57 −The msDS-Behavior-Version attribute is on the naming context (NC) head for the domain.

69 +1. In the **Connection Settings** dialog box, select **OK** to using the defaults to connect to the Default naming context for the current domain.

5870

59 −You can set the following values for this attribute:

71 +1. Expand the **Default naming context** node then right-click the domain node, and then select **Properties**.

6072

61 −- 0 or no setting = mixed level domain

62 −- 1 = Windows Server 2003 domain level

63 −- 2 = Windows Server 2003 domain level

64 −- 3 = Windows Server 2008 domain level

65 −- 4 = Windows Server 2008 R2 domain level

73 +1. In the **Properties** dialog box, locate the **msDS-Behavior-Version** attribute. This attribute contains the current domain functional level.

6674

67 −#### Mixed mode and native mode settings

75 +The `msDS-Behavior-Version` attribute represents the highest possible functional level for this domain controller. The values for this attribute are:

6876

69 −The ntMixedDomain attribute is on the naming context (NC) head for the domain, that is, DC=corp, DC=contoso, DC=com.

77 +- Windows Server 2000: `0` or `Windows2000Domain`

7078

71 −You can set the following values for this attribute:

79 +- Windows Server 2003 Interim Domain: `1` or `Windows2003InterimDomain`

7280

73 −- 0 = Native level domain

74 −- 1 = Mixed level domain

81 +- Windows Server 2003: `2` or `Windows2003Domain`

7582

76 −#### Forest level setting

83 +- Windows Server 2008: `3` or `Windows2008Domain`

7784

78 −The msDS-Behavior-Version attribute is on the CN=Partitions object in the Configuration naming context (NC), that is, CN=Partitions, CN=Configuration, DC= ForestRootDomain.

85 +- Windows Server 2008 R2: `4` or `Windows2008R2Domain`

7986

80 −You can set the following values for this attribute:

87 +- Windows Server 2012: `5` or `Windows2012Domain`

8188

82 −- 0 or not set = mixed level forest

83 −- 1 = Windows Server 2003 interim forest level

84 −- 2 = Windows Server 2003 forest level

89 +- Windows Server 2012 R2: `6` or `Windows2012R2Domain`

8590

86 − > [!NOTE]

87 − > When you increase the msDS-Behavior-Version attribute value from 0 to 1 using Adsiedit.msc, an error message appears that says "Illegal modify operation. Some aspect of the modification is not permitted."

91 +- Windows Server 2016: `7` or `WinThreshold`

8892

89 −- 3 = Windows Server 2008 domain level

90 −- 4 = Windows Server 2008 R2 domain level

93 +- Windows Server 2025: `10` or `Windows2025Domain`

9194

92 −After you use the Lightweight Directory Access Protocol (LDAP) tools to edit the functional level, select **OK** to continue. The attributes on the partitions container and on the domain head automatically increase to the correct levels. If the Ldp.exe file displays an error message, you can safely ignore it. To verify that the level increase was successful, refresh the attribute list, then check the current settings. This error message may also appear after you increase the level on the authoritative FSMO if the change hasn't replicated to the local domain controller yet.

95 +### Mixed mode and native mode

9396

94 −To use the Ldp.exe file to view the current settings:

97 +The `ntMixedDomain` attribute, also located in the default naming context properties, shows the domain mode.

9598

96 −1. Open the Ldp.exe file.

97 −2. On the **Connection** menu, select **Connect**.

98 −3. Specify the domain controller that you want to query, or leave the space blank to connect to any domain controller.

99 +The following are the values for this attribute:

99100

100 −After you connect to a domain controller, the RootDSE information for the domain controller appears. This information includes information on the forest, domain, and domain controllers. The following example shows a Windows Server 2003-based domain controller. In the following example, assume that the domain mode is Windows Server 2003 and that the forest mode is Windows 2000 Server.

101 +- `0` = Native level domain

101102

102 −> [!NOTE]

103 −> The domain controller functionality represents the highest possible functional level for this domain controller.

104 −>

105 −> `1> domainFunctionality: 2=(DS_BEHAVIOR_WIN2003)`

106 −> `1> forestFunctionality: 0=(DS_BEHAVIOR_WIN2000)`

107 −> `1> domainControllerFunctionality: 2=(DS_BEHAVIOR_WIN2003)`

103 +- `1` = Mixed level domain

108104

109 −### Requirements when you manually change the functional level

105 +### Forest level

110106

111 −- You must change the domain mode to native mode before you raise the domain level if one of the following conditions is true:

112 − - The domain functional level is programmatically raised to the second functional level by directly modifying the value of the msdsBehaviorVersion attribute on the domainDNS object.

113 − - The domain functional level is raised to the second functional level by using the Ldp.exe utility or the Adsiedit.msc utility.

107 +To view the current forest functional level, use _ADSI Edit_ to view the current `msDS-Behavior-Version` attribute for the forest. Follow the steps to view the `msDS-Behavior-Version` attribute in the CN=Partitions object found in the Configuration naming context (NC).

114108

115 − If you don't change the domain mode to native mode before you raise the domain level, the operation can't finish successfully, and you receive the following error messages:

109 +1. From ADSI Edit, right-click the **ADSI Edit** node, and then select **Connect to**.

116110

117 − `SV_PROBLEM_WILL_NOT_PERFORM`

118 − `ERROR_DS_ILLEGAL_MOD_OPERATION`

111 +1. In the **Connection Settings** dialog box, select **Configuration** from the **Select a well known Naming Context**, then select **OK**.

119112

120 − The following message also appears in the Directory Services log:

113 +1. Expand the **Configuration** node, then the configuration container. The container is in the form of `CN=Configuration,DC=<domain name>,DC=<top level domain>`.

121114

122 − ```output

123 − Active Directory could not update the functional level of the following domain because the domain is in mixed mode.

124 − ```

115 +1. Right-click the **CN=Partitions** container, and then select **Properties**.

125116

126 − In this scenario, you can change the domain mode to native mode by using the Active Directory Users & Computers snap-in, the Active Directory Domains & Trusts UI MMC snap-in, or by programmatically changing the value of the ntMixedDomain attribute to 0 on the domainDNS object. When you use this process to raise the domain functional level to 2 (Windows Server 2003), the domain mode automatically changes to native mode.

117 +1. In the **Properties** dialog box, locate the **msDS-Behavior-Version** attribute. This attribute contains the current forest functional level.

127118

128 −- The transition from mixed mode to native mode changes the scope of the Schema Administrators security group and the Enterprise Administrators security group to universal groups. When you change these groups to universal groups, the following message appears in the System log:

119 +The `msDS-Behavior-Version` attribute represents the highest possible functional level for this forest. The values for this attribut eare:

129120

130 − ```output

131 − Event Type: Information

132 − Event Source: SAM

133 − Event ID: 16408

134 − Computer:Server Name

135 − Description: "Domain operation mode has been changed to Native Mode. The change cannot be reversed."

136 − ```

121 +- Windows Server 2000: `0` or `Windows2000Forest`

137122

138 −When you use the Windows Server 2003 administrative tools to invoke the domain functional level, both the ntmixedmode attribute and the msdsBehaviorVersion attribute are modified in the correct order. However, this modification doesn't always occur. In the following scenario, the native mode is implicitly set to a value of 0 without changing the scope for the Schema Administrators security group and the Enterprise Administrators security group to universal:

123 +- Windows Server 2003 Interim Forest: `1` or `Windows2003InterimForest`

139124

140 −- The value of the msdsBehaviorVersion attribute that controls the domain functional mode is manually or programmatically set to 2.

141 −- The forest functional level is set to 2 by using any method. In this scenario, the Domain controllers block the transition to the forest functional level until all of the domains that are in the local area network are configured to native mode and the required attribute change is made in the security group scopes.

125 +- Windows Server 2003: `2` or `Windows2003Forest`

142126

143 −### Functional levels relevant to Windows Server 2016, Windows Server 2022, and Windows Server 2025 (preview)

127 +- Windows Server 2008: `3` or `Windows2008Forest`

144128

145 −There are many considerations when raising the operating system level of the domain controller. These considerations are caused by the storage and replication limitations of the linked attributes in Windows Server modes.

129 +- Windows Server 2008 R2: `4` or `Windows2008R2Forest`

146130

147 −## Increasing functional levels

131 +- Windows Server 2012: `5` or `Windows2012Forest`

148132

149 −The following section discusses the method for increasing functional levels. The section is broken into two parts. "Preparation Tasks" discusses the work that you must do before the increase and "Optimal Paths Increase" discusses the motivations and methods for different level increase scenarios.

133 +- Windows Server 2012 R2: `6` or `Windows2012R2Forest`

150134

151 −### Example: Preparation tasks before the level increase

135 +- Windows Server 2016: `7` or `WinThreshold`

152136

153 −In this example, the environment is raised from Windows Server 2000 mixed mode to Windows Server 2003 forest mode. This example assumes that an accurate server list is not available and that you have performed an inventory of the forest for earlier versions of domain controllers.

137 +- Windows Server 2025: `10` or `Windows2025Forest`

154138

155 −1. To discover mixed level domains, Windows Server 2000 domain controllers, or domain controllers with damaged or missing objects, use Active Directory domains and the Trusts MMC snap-in.

156 −2. In the snap-in, select **Raise Forest Functionality**, and then select **Save As** to generate a detailed report.

157 −3. If no problems were found, the option to increase to Windows Server 2003 forest level is available from the **"Available Forest Functional Levels"** drop-down list. When you try to raise the forest level, the domain controller objects in the configuration containers are searched for any domain controllers that do not have **msds-behavior-version** set to the desired target level. These are assumed to be either Windows Server 2000 domain controllers or newer Windows Server domain controller objects that are damaged.

158 −4. If earlier version domain controllers or domain controllers that have damaged or missing computer objects were found, they are included in the report. The status of these domain controllers must be investigated, and the domain controller representation in Active Directory must be repaired or removed by using the Ntdsutil file.

139 +## Raise the functional level

159140

160 −For more information, see [KB 216498](https://support.microsoft.com/help/216498).

141 +To raise the domain and forest functional levels, you can use the Active Directory Domains and Trusts console or Windows PowerShell. The following sections describe how to raise the functional levels using these methods.

161142

162 −### Verify end-to-end replication is working in the forest

143 +> [!WARNING]

144 +> Changes to the domain and forest functional levels are irreversible. In order to undo the change, you must perform a forest recovery to revert to an earlier point of time.

163145

164 −To verify that end-to-end replication is working in the forest, use the Windows Server 2003 or newer version of Repadmin against the Windows Server or the Windows Server domain controllers:

146 +### [Desktop](#tab/desktop)

165147

166 −- `Repadmin/Replsum * /Sort:Delta[/Errorsonly]` for initial inventory.

167 −- `Repadmin/Showrepl * /CSV>showrepl.csv`. Import to Excel, and then use the Data->Autofilter to identify replication features.

148 +To raise the domain or forest functional level using the Active Directory Domains and Trusts console, follow these steps.

168149

169 −Use replication tools such as Repadmin to verify that forest-wide replication is working correctly.

150 +1. Sign in to a domain controller.

170151

171 −Verify the compatibility of all programs or services with the newer Windows Server domain controllers and with the higher Windows Server domain and forest mode. Use a lab environment to thoroughly test production programs and services for compatibility issues. If you're unsure if a program is compatible, contact the vendors.

152 +1. Select the Start menu, then enter _Active Directory Domains and Trusts_ in the search box.

172153

173 −Prepare a back-out plan that includes of one of the following actions:

154 +1. Open the **Active Directory Domains and Trusts** app.

174155

175 −- Disconnect at least two domain controllers from each domain in the forest.

176 −- Create a system state backup of at least two domain controllers from each domain in the forest.

156 +1. In the console tree, right-click the domain node, and then select **Raise Domain Functional Level**.

177157

178 −Before the back-out plan can be used, all domain controllers in the forest must be decommissioned before the recovery process.

158 +1. In **Select an available domain functional level**, select the value and then select **Raise**.

179159

180 −> [!NOTE]

181 −> You can't authoritatively restore level increases. You must decommission all domain controllers that replicated the level increase.

160 +1. When prompted, select **OK** to confirm the change.

182161

183 −After you decommission all previous domain controllers, bring up the disconnected domain controllers or restore the domain controllers from the backup. Remove the metadata from all the other domain controllers, then repromote them.

162 +1. Once the domain functional level is raised, raise the forest functional level. In the console tree, right-click **Active Directory Domains and Trusts** , and then select **Raise Forest Functional Level**.

184163

164 +1. In **Select an available forest functional level**, select the value and then select **Raise**.

165 +

166 +You've now raised the domain and forest functional level.

167 +

168 +### [PowerShell](#tab/PowerShell)

169 +

170 +To raise the domain or forest functional level using PowerShell, follow these steps.

171 +

172 +1. Sign in to a domain controller.

173 +

174 +1. Open PowerShell as an administrator.

175 +

176 +1. Run the following command to raise the domain functional level, replacing `<domain>` with the domain name and `<level>` with the desired domain functional level.

177 +

178 + ```powershell

179 + Set-ADDomainMode -Identity <domain> -DomainMode <level>

180 + ```

181 +

182 +1. To confirm the change, select **Y**.

183 +

184 +1. Once the domain functional level is raised, run the following command to raise the forest functional level, replacing `<level>` with the desired forest functional level.

185 +

186 + ```powershell

187 + Set-ADForestMode -Identity <forest> -ForestMode <level>

188 + ```

189 +

190 +1. To confirm the change, select **Y**.

191 +

192 +You've now raised the domain and forest functional level.

193 +

194 +---

195 +

185196 ## Related content

186197

187 −- [What's new in Active Directory Domain Services for Windows Server 2016](/windows-server/identity/whats-new-active-directory-domain-services).

198 +- [Forest and Domain Functional Levels](../active-directory-functional-levels.md)

199 +

200 +- [Identifying Your Functional Level Upgrade](Identifying-Your-Functional-Level-Upgrade.md)

AD domain and forest functional levels

Microsoft's edit · 24 Sep 2024 23:23 UTC