Forest and domain functional levels: what each level actually brings to security
We still regularly find domains whose controllers run a recent Windows Server release while the functional level is stuck a decade in the past. The result: several major protections exist on paper but are not enforced on the domain controller side.
What a functional level is for
Domain and forest functional levels state the minimum Windows Server version that every domain controller is expected to run. Until the level is raised, Active Directory must stay compatible with the oldest possible controllers, so it does not turn on certain behaviours. Functional levels only concern domain controllers: they impose nothing on workstations or member servers, which keep working regardless of their operating system.
A common misunderstanding: upgrading every controller to Windows Server 2022 or 2025 does not raise the functional level automatically. It is a separate administrative action that has to be decided and scheduled.
What each level unlocks
| Level | Notable security benefits |
|---|---|
| Windows Server 2008 R2 | Prerequisite for the Active Directory Recycle Bin (forest level), authentication mechanism assurance |
| Windows Server 2012 R2 | Domain controller-side protections for the Protected Users group, authentication policies and authentication policy silos |
| Windows Server 2016 | Automatic rolling of NTLM secrets for smart card-required accounts, Privileged Access Management (PAM) at forest level, Windows LAPS password encryption |
| Windows Server 2025 | A new functional level that gates some of this release's features, such as 32 KB database pages |
Protected Users is the textbook case. On the client side, members of this group no longer cache certain secrets. But the protections enforced by the domain controller (no NTLM authentication, no DES or RC4 in Kerberos pre-authentication, shorter TGT lifetime, no delegation) require a domain at Windows Server 2012 R2 level or higher. Below that, the group only provides partial protection, which creates a false sense of security.
Windows Server 2025 and minimum levels
Windows Server 2025 introduces a new domain and forest functional level. Promoting a controller running this release itself requires a minimum forest and domain functional level; check current Microsoft documentation for the exact requirements before planning your migration. Another frequently forgotten prerequisite: SYSVOL replication must use DFS-R rather than the legacy FRS service, which was dropped several releases ago.
Raising the level without breaking things
Raising a level is effectively one-way: rolling back is only possible in limited cases, and never once certain optional features are enabled. It therefore needs preparation.
- Inventory every domain controller, including those in remote sites and RODCs, and check their versions.
- Look for orphaned controller objects: a badly demoted DC blocks the change or skews the inventory.
- Check replication and SYSVOL health before making any change.
- Identify applications that rely on RC4, NTLM or delegation for accounts you plan to add to Protected Users.
- Raise the domain level first, then the forest level, ideally starting with a test environment or a secondary domain.
Raising the level is not the real risk. Changing the functional level does not alter how ordinary accounts behave. It is the features you enable afterwards (Protected Users, authentication policies) that can break legacy usage, so roll them out gradually, one account at a time.
What an audit checks
- the current forest and domain functional levels, compared with the controllers' versions;
- outdated controllers or orphaned objects that prevent raising the level;
- actual use of Protected Users and authentication policies for privileged accounts;
- the SYSVOL replication mode and the status of optional features such as the Recycle Bin.