Domain and forest functional levels in Active Directory define the available features and supported operating systems for domain controllers within a domain or forest. They essentially act as flags that indicate the minimum operating system version required for all domain controllers in a specific scope (domain or forest). This ensures compatibility and enables new features that require a certain level of infrastructure.

The Domain and Forest functional levels are named the same a Windows server operating systems, such as:

• Windows Server 2008
• Windows Server 2003
• Windows Server 2012 R2
• Windows Server 2016

The maximum level that the forest and domain can be raised to is the same as the oldest version of Windows server hosting AD services. For example, if you have three domain controllers one running Windows Server 2012 R2, one running Windows Server 2016 and one running Windows Server 2019, the domain and forest levels can only be raised to Windows Server 2012 R2 as this matches the OS of the oldest domain controller on the network.

Typically, we raise the levels after demoting old domain controllers, in some cases, raising these levels is required to support newer Exchange server platforms or newer versions of EntraID Connect.

Once either a forest or domain level has been raised, it cannot be downgraded – preventing you from promoting domain controllers running older OS versions that the current functional levels. This means that once the Server 2012 R2 DC has been demoted and the AD functional levels have been raised (to say 2016), you can no longer promote Server 2012 R2 (or older versions) to a DC. Only Windows Server 2016 and newer can be domain controllers going forward.

Ideally, the functional levels should be raised on writable domain controllers that also host a copy of the global catalog – not on a read only DC, or a DC that doesn’t store a copy of the GC. (Generally speaking, the guides on our Intranet walk you through deploying RW DCs with GC).

All domain controllers should be online and connected / contactable from all other DC’s before making changes.

There are multiple methods to raise these levels, we’ll focus on just two methods in this guide.

On any writable domain controller launch the following server applets:

• Active Directory Domains and Trusts
• Active Directory Users and Computers

Starting in AD Domains and Trusts, on the left tree, right click the first item in the top of the tree labelled Active Directory Domains and Trusts

Select Raise Forest Functional Level from the context menu

In the popup, you’ll see the current forest level and a dropdown list where you can choose the available functional levels you can upgrade to

Select and click Raise.

It will take about one second and then will tell you its been completed.

Close this window

Switch over to Active Directory Users and Computers

Right click in the top most left tree item

Select All Tasks > Raise domain functional level from the context menu

Just like the forest functional level screen earlier, you’ll see the current level and a dropdown list to select the available domain functional levels you can raise to.

Select the new level and click Raise

Again, this should take up to a second and inform you that the domain level has been raised.

And that’s it – job done!

Use the Set-ADForestMode cmdlet to raise the forest functional level

Set-ADForestMode -Identity <domain> -DomainMode <level>

Example:

Set-ADForestMode -Identity drfs.local -DomainMode Windows2016Forest

You will be prompted to confirm, type Y and press enter

You will be returned to prompt almost immediately with no output, to confirm the upgrade was successful, execute:

Get-ADForest | fl Name, ForestMode

You should see output like this:

Now we can upgrade the domain functiona level using:

Set-ADDomainMode -Identity <domain> -DomainMode <level>

Example:

Set-ADDomainMode -Identity drfs.local -DomainMode Windows2016Domain

Again, you’ll be prompted to confirm, type Y and press Enter

You will be returned to prompt almost immediately with no output, to confirm the upgrade was successful, execute:

Get-ADDomain | fl Name, DomainMode

That’s it – job done!