Applies To: Windows Server 2008, Windows Server 2008 R2
Functional levels determine the available Active Directory Domain Services (AD DS) domain or forest capabilities. They also determine which Windows Server operating systems you can run on domain controllers in the domain or forest. However, functional levels do not affect which operating systems you can run on workstations and member servers that are joined to the domain or forest.
When you deploy AD DS, set the domain and forest functional levels to the highest value that your environment can support. This way, you can use as many AD DS features as possible. For example, if you are sure that you will never add domain controllers that run Windows Server 2003 to the domain or forest, select the Windows Server 2008 functional level during the deployment process. However, if you might retain or add domain controllers that run Windows Server 2003, select the Windows Server 2003 functional level.
When you deploy a new forest, you are prompted to set the forest functional level and then set the domain functional level. You cannot set the domain functional level to a value that is lower than the forest functional level. For example, if you set the forest functional level to Windows Server 2008, you can set the domain functional level only to Windows Server 2008. The Windows 2000 native and Windows Server 2003 domain functional level values are not available on the Set domain functional level page of the Active Directory Domain Services Installation Wizard. In addition, all domains that you subsequently add to that forest have the Windows Server 2008 domain functional level by default.
You can set the domain functional level to a value that is higher than the forest functional level. For example, if the forest functional level is Windows Server 2003, you can set the domain functional level to Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2.
The following sections describe the features that are available at the different functional levels.
Features that are available at domain functional levels
The following table shows the features that are available at each domain functional level.
|
Domain functional level |
Available features |
Supported domain controller operating systems |
||
|
Windows 2000 native |
All of the default AD DS features and the following directory features are available: · Universal groups for both distribution and security groups. · Group nesting · Group conversion, which allows conversion between security and distribution groups · Security identifier (SID) history
|
· Windows 2000 · Windows Server 2003 · Windows Server 2008 · Windows Server 2008 R2 |
||
|
Windows Server 2003 |
All the default AD DS features, all the features that are available at the Windows 2000 native domain functional level, and the following features are available: · The domain management tool, Netdom.exe, which makes it possible for you to rename domain controllers · Logon time stamp updates · The ability to set the userPassword attribute as the effective password on inetOrgPerson and user objects · The ability to redirect Users and Computers containers · The ability for Authorization Manager to store its authorization policies in AD DS · Constrained delegation · Selective authentication |
· Windows Server 2003 · Windows Server 2008 · Windows Server 2008 R2 |
||
|
Windows Server 2008 |
All of the default AD DS features, all of the features from the Windows Server 2003 domain functional level, and the following features are available: · Distributed File System (DFS) replication support for the Windows Server 2003 System Volume (SYSVOL) · Domain-based DFS namespaces running in Windows Server 2008 Mode, which includes support for access-based enumeration and increased scalability. Domain-based namespaces in Windows Server 2008 mode also require the forest to use the Windows Server 2003 forest functional level. For more information, see Choose a Namespace Type (http://go.microsoft.com/fwlink/?LinkId=180400). · Advanced Encryption Standard (AES 128 and AES 256) support for the Kerberos protocol · Last Interactive Logon Information · The total number of failed logon attempts at a domain-joined Windows Server 2008 server or a Windows Vista workstation · The total number of failed logon attempts after a successful logon to a Windows Server 2008 server or a Windows Vista workstation · The time of the last failed logon attempt at a Windows Server 2008 or a Windows Vista workstation · The time of the last successful logon attempt at a Windows Server 2008 server or a Windows Vista workstation For more information, see Active Directory Domain Services: Last Interactive Logon (http://go.micro · Fine-grained password policies · Personal Virtual Desktops |
· Windows Server 2008 · Windows Server 2008 R2 |
||
|
Windows Server 2008 R2 |
All default Active Directory features, all features from the Windows Server 2008 domain functional level, plus the following features: · Authentication mechanism assurance, which packages information about the type of logon method (smart card or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorization based on a user’s logon method. · Automatic SPN management for services running on a particular computer under the context of a Managed Service Account when the name or DNS host name of the machine account changes. For more information about Managed Service Accounts, see Service Accounts Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=180401). |
· Windows Server 2008 R2 |
Features that are available at forest functional levels
The following table shows the features that are available at each forest functional level.
|
Forest functional level |
Available features |
Supported domain controllers |
|
Windows 2000 native |
All of the default AD DS features are available. |
· Windows Server 2008 R2 · Windows Server 2008 · Windows Server 2003 · Windows 2000 |
|
Windows Server 2003 |
All of the default AD DS features, and the following features, are available: · Forest trust · Domain rename · Linked-value replication · The ability to deploy a read-only domain controller (RODC) · Improved Knowledge Consistency Checker (KCC) algorithms and scalability · The ability to create instances of the dynamic auxiliary class named dynamicObject in a domain directory partition · The ability to convert an inetOrgPerson object instance into a User object instance, and to complete the conversion in the opposite direction · The ability to create instances of new group types to support role-based authorization. · Deactivation and redefinition of attributes and classes in the schema. The following attributes can be reused: ldapDisplayName, schemaIdGuid, OID, and mapiID. · Domain-based DFS namespaces running in Windows Server 2008 Mode, which includes support for access-based enumeration and increased scalability. For more information, see Choose a Namespace Type (http://go.microsoft.com/fwlink/?LinkId=180400). |
· Windows Server 2003 · Windows Server 2008 · Windows Server 2008 R2 |
|
Windows Server 2008 |
All of the features that are available at the Windows Server 2003 forest functional level, but no additional features are available. All domains that are subsequently added to the forest, however, operate at the Windows Server 2008 domain functional level by default. |
· Windows Server 2008 · Windows Server 2008 R2 |
|
Windows Server 2008 R2 |
All of the features that are available at the Windows Server 2003 forest functional level, plus the following features: · Active Directory Recycle Bin, which provides the ability to restore deleted objects in their entirety while AD DS is running. All domains that are subsequently added to the forest will operate at the Windows Server 2008 R2 domain functional level by default. If you plan to include only domain controllers that run Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience. If you do, you will never have to raise the domain functional level for each domain that you create in the forest. |
· Windows Server 2008 R2 |
Guidelines for raising domain and forest functional levels
The following guidelines apply to raising the domain or forest functional levels:
· You must be a member of the Domain Admins group to raise the domain functional level.
· You must be a member of the Enterprise Admins group to raise the forest functional level.
· You can raise the domain functional level on the primary domain controller (PDC) emulator operations master only. The AD DS administrative tools that you use to raise the domain functional level (the Active Direc
tory Domains and Trusts snap-in and the Active Directory Users and Computers snap-in) automatically target the PDC emulator when you raise the domain functional level.
· You can raise the forest functional level on the schema operations master only. Active Directory Domains and Trusts automatically targets the schema operations master when you raise the forest functional level.
· You can raise the functional level of a domain only if all domain controllers in the domain run the version or versions of Windows that the new functional level supports.
· You can raise the functional level of a forest only if all domain controllers in the forest run the version or versions of Windows Server operating system that the new functional level supports.
· You cannot set the domain functional level to a value that is lower than the forest functional level, but you can set it to a value that is equal to or higher than the forest functional level.
· With versions of Windows Server that are earlier than Windows Server 2008 R2, you cannot roll back or lower a functional level under any circumstances. If you have to revert to a lower functional level with a version of Windows Server that is earlier than Windows Server 2008 R2, you must rebuild the domain or forest or restore it from a backup copy.
· After you set the domain functional level to a certain value in Windows Server 2008 R2, you cannot roll back or lower the domain functional level, with one exception: when you raise the domain functional level to Windows Server 2008 R2 and if the forest functional level is Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008. You can lower the domain functional level only from Windows Server 2008 R2 to Windows Server 2008. If the domain functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.
· After you set the forest functional level to a certain value in Windows Server 2008 R2, you cannot roll back or lower the forest functional level, with one exception: when you raise the forest functional level to Windows Server 2008 R2 and if the Active Directory Recycle Bin is not enabled, you have the option of rolling the forest functional level back to Windows Server 2008. For more information about the Active Directory Recycle Bin, see What’s New in AD DS: Active Directory Recycle Bin (http://go.microsoft.com/fwlink/?LinkId=141392). You can lower the forest functional level only from Windows Server 2008 R2 to Windows Server 2008. If the forest functional level is set to Windows Server 2008 R2, it cannot be rolled back to Windows Server 2003, for example.
