Raising domain and forest functional levels: method and security benefits
Functional levels are often seen as an administrative formality that can be postponed indefinitely. Yet they determine access to important protections: Kerberos AES, the Active Directory Recycle Bin, the Protected Users group, authentication policies. We still come across forests stuck at levels more than fifteen years old.
What a functional level is
The domain functional level, and the forest functional level, define the minimum version of Windows Server that domain controllers may run. They have nothing to do with the version of client machines or member servers. By raising the level, you assure the directory that no older domain controller is present, which allows it to enable features those older controllers could not handle.
The levels available today range from Windows Server 2008 to Windows Server 2016, followed by Windows Server 2025, which introduces a new level after a long period without change. Versions 2019 and 2022 did not bring a level of their own: their domain controllers run at the 2016 level.
What each level brings for security
- 2008: AES support for Kerberos, fine-grained password policies, SYSVOL replication using DFSR;
- 2008 R2 (forest): the ability to enable the Active Directory Recycle Bin; authentication mechanism assurance;
- 2012: DC-side support for claims, compound authentication and Kerberos armoring (FAST);
- 2012 R2: DC-side protections for the Protected Users group, authentication policies and silos;
- 2016: automatic rolling of NTLM secrets for accounts that require a smart card, forest-level privileged access management features;
- 2025: a prerequisite for some recent changes to the directory database, such as the optional 32 KB database page feature.
In practice, the minimum we recommend is the 2016 level: it guarantees that all modern DC-side protections are available. The 2025 level requires every domain controller to run Windows Server 2025, which is a goal to plan for rather than an immediate prerequisite.
Old accounts. An account whose password was set before the move to the 2008 level may not have AES keys. With RC4 being progressively deprecated, these accounts, often service accounts, are the first to cause problems. Inventorying them is part of the project.
Prerequisites
- A complete inventory of domain controllers, including those that disappeared without being properly demoted: their metadata must be cleaned up, otherwise the directory still considers them present.
- Replacing old domain controllers with controllers on a supported version, then demoting the old ones.
- Migrating SYSVOL replication from FRS to DFSR if this has not been done. FRS is obsolete, and recent versions of Windows Server cannot be promoted in a domain that still uses it. The migration goes through several successive states that remain reversible until the last one.
- Replication health: no functional level raise should be attempted on a forest whose replication shows errors.
- Dependency checks: third-party appliances or products that interact with the directory, especially those that present themselves as domain controllers or synchronise passwords.
The raise itself
You raise the level of each domain first, then the forest, which cannot exceed the lowest level among its domains. The operation itself is quick and replicates like any other change. It should nevertheless be treated as irreversible: rolling back is only possible in limited cases, and not at all once certain features, such as the Recycle Bin, have been enabled. Have a recent, validated system state backup of your domain controllers before acting.
Raising the level does not switch everything on automatically. The Active Directory Recycle Bin is enabled separately, Kerberos armoring and authentication policies are configured through Group Policy, and Protected Users membership still needs to be organised. The functional level opens doors; the hardening project has to walk through them.
What an audit checks
- The functional levels of each domain and of the forest.
- Operating system versions of domain controllers and leftover metadata from vanished controllers.
- The SYSVOL replication mechanism and the status of the DFSR migration.
- Replication health.
- Privileged or service accounts without AES keys.
- Whether the features enabled by the level reached are actually in use.