Setting the Domain or Forest Functional Level
Functional levels determine the features of Active Directory Domain Services (AD DS) that are enabled in a domain or forest. They also restrict which Windows Server operating systems can run on domain controllers in the domain or forest. However, functional levels do not affect which operating systems can run on workstations and member servers that are joined to the domain or forest.
When you create a new domain or a new forest, set the domain and forest functional levels to the highest values that you know your environment can support. This way, you can take advantage of as many AD DS features as possible. For example, if you are sure that no domain controllers that run Windows Server 2008 (or any earlier operating system) will ever be added to the domain or forest, select the Windows Server 2008 R2 functional level. On the other hand, if it is possible that you will retain or add domain controllers that run Windows Server 2008 or earlier, select the Windows Server 2008 functional level during installation. You can raise the functional level after the installation, when you are sure that no such domain controllers will be added or are still in use.
When you install a new forest, you are prompted to set the forest functional level and then the domain functional level. You cannot set the domain functional level to a value that is lower than the forest functional level. For example, if you set the forest functional level to Windows Server 2008 R2, you can set the domain functional level only to Windows Server 2008 R2. The Windows 2000, Windows Server 2003, and Windows Server 2008 domain functional level values will not be available on the Set domain functional level wizard page. In addition, all domains that you subsequently add to that forest will have the Windows Server 2008 R2 domain functional level by default.
After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with one exception: when you raise the domain functional level to Windows Server 2008 R2 and if the forest functional level is Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008. You can lower the domain functional level only from Windows Server 2008 R2 to Windows Server 2008. If the domain functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.
After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with one exception: when you raise the forest functional level to Windows Server 2008 R2 and if Active Directory Recycle Bin is not enabled, you have the option of rolling the forest functional level back to Windows Server 2008. You can lower the forest functional level only from Windows Server 2008 R2 to Windows Server 2008. If the forest functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.
The following sections explain the sets of features that are enabled at the different domain and forest functional levels.
| Domain functional Level | Enabled features | Supported domain controller operating systems |
| Windows 2000 native | All default Active Directory features, plus the following | Windows 2000 |
| features: | Windows Server 2003 | |
| Universal groups for both distribution groups | Windows Server 2008 | |
| and security groups | Windows Server 2008 R2 | |
| Group nesting | Server 2008 R2 | |
| Group conversion, which makes conversion | ||
| possible between security groups and | ||
| distribution groups | ||
| Security identifier (SID) history | ||
| Windows Server 2003 | All default Active Directory features, all features from | Windows Server 2003 |
| the Windows 2000 native domain functional level, plus | Windows Server 2008 | |
| the following features: | Windows Server 2008 R2 | |
| The domain management tool, Netdom.exe, is | ||
| available to prepare for domain controller | ||
| rename. | ||
| Logon time stamp update. The | ||
| lastLogonTimestamp attribute will be updated | ||
| with the last logon time of the user or | ||
| computer. This attribute is replicated within the | ||
| domain. Note that this attribute might not be | ||
| updated if a read-only domain controller (RODC) | ||
| authenticates the account. | ||
| The userPassword attribute can be set as the | ||
| effective password on inetOrgPerson objects | ||
| and user objects. | ||
| Users and Computers containers can be | ||
| redirected. By default, two well-known | ||
| containers are provided for housing computer | ||
| and user/group accounts: | ||
| cn=Computers,<domain root> and | ||
| cn=Users,<domain root>. With this feature, you | ||
| can define a new well-known location for these | ||
| accounts. | ||
| Authorization Manager can store its | ||
| authorization policies in AD DS. | ||
| Constrained delegation, which makes it possible | ||
| for applications to take advantage of the secure | ||
| delegation of user credentials by means of the | ||
| Kerberos authentication protocol. You can | ||
| configure delegation to be allowed only to | ||
| specific destination services. | ||
| Support for selective authentication, which | ||
| makes it possible to specify the users and | ||
| groups from a trusted forest who are allowed to | ||
| authenticate to resource servers in a trusting | ||
| forest. | ||
| Windows Server 2008 | All default Active Directory features, all features from | Windows Server 2008 |
| the Windows 2000 native and the | Windows Server 2008 R2 | |
| Windows Server 2003 domain functional levels, plus | ||
| the following features: | ||
| Distributed File System (DFS) Replication | ||
| support for SYSVOL, which provides more | ||
| robust and detailed replication of SYSVOL | ||
| contents. You may need to perform additional | ||
| steps to use DFS Replication for SYSVOL. For | ||
| more information, see File Services | ||
| (http://go.microsoft.com/fwlink/? | ||
| LinkId=93167). | ||
| Advanced Encryption Services (AES 128 and | ||
| 256) support for the Kerberos protocol. | ||
| Last Interactive Logon Information, which | ||
| displays the time of the last successful | ||
| interactive logon for a user, from what | ||
| workstation, and the number of failed logon | ||
| attempts since the last logon. | ||
| Fine-grained password policies, which make it | ||
| possible for password and account lockout | ||
| policies to be specified for users and global | ||
| security groups in a domain. | ||
| Windows Server 2008 R2 | All default Active Directory features, all features from | Windows Server 2008 R2 |
| the Windows 2000 native, Windows Server 2003, and | ||
| Windows Server 2008 functional levels, plus the | ||
| following feature: | ||
| Authentication Mechanism Assurance, which | ||
| packages information about the type of logon | ||
| method (smartcard or user name/password) | ||
| that is used to authenticate domain users inside | ||
| each user’s Kerberos token. When this feature is | ||
| enabled in a network environment that has | ||
| deployed a federated identity management | ||
| infrastructure, such as Active Directory | ||
| Federation Services (AD FS), the information in | ||
| the token can then be extracted whenever a | ||
| user attempts to access any claims-aware | ||
| application that has been developed to | ||
| determine authorization based on a user’s logon | ||
| method. |
The following table lists the enabled features and supported domain controller operating systems for each forest functional level.
| Domain functional Level | Enabled features | Supported domain controller operating systems |
| Windows 2000 | All default Active Directory features | Windows 2000 |
| Windows Server 2003 | ||
| Windows Server 2008 | ||
| Windows Server 2008 R2 | ||
| Windows Server 2003 | All default Active Directory features, plus the following | Windows Server 2003 |
| features: | Windows Server 2008 | |
| Forest trust | Windows Server 2008 R2 | |
| Domain rename | ||
| Linked-value replication (changes in group | ||
| membership to store and replicate values for | ||
| individual members instead of replicating the entire | ||
| membership as a single unit). This change results in | ||
| lower network bandwidth and processor usage | ||
| during replication, and it eliminates the possibility of | ||
| lost updates when different members are added or | ||
| removed concurrently at different domain | ||
| controllers. | ||
| The ability to deploy an RODC | ||
| Improved Knowledge Consistency Checker (KCC) | ||
| algorithms and scalability. The intersite topology | ||
| generator (ISTG) uses improved algorithms that | ||
| scale to support forests with a greater number of | ||
| sites than can be supported at the Windows 2000 | ||
| forest functional level. | ||
| The ability to create instances of the dynamic | ||
| auxiliary class called dynamicObject in a domain | ||
| directory partition | ||
| The ability to convert an inetOrgPerson object | ||
| instance into a User object instance, and the | ||
| reverse | ||
| The ability to create instances of the new group | ||
| types, called application basic groups and | ||
| Lightweight Directory Access Protocol (LDAP) query | ||
| groups, to support role-based authorization | ||
| Deactivation and redefinition of attributes and | ||
| classes in the schema | ||
| Windows Server 2008 | All the features that are available at the | Windows Server 2008 |
| Windows Server 2003 forest functional level, but no | Windows Server 2008 R2 | |
| additional features. All domains that are subsequently | ||
| added to the forest, however, will operate at the Windows | ||
| Server 2008 domain functional level by default. | ||
| If you plan to include only domain controllers that run | ||
| Windows Server 2008 or Windows Server 2008 R2 in the | ||
| entire forest, you might choose this forest functional level | ||
| for administrative convenience. | ||
| Windows Server 2008 R2 | All of the features that are available at the | Windows Server 2008 R2 |
| Windows Server 2003 forest functional level, plus the | ||
| following feature: | ||
| Recycle Bin, which provides the ability to restore | ||
| deleted objects in their entirety while AD DS is | ||
| running. | ||
| All domains that are subsequently added to the forest will | ||
| operate at the Windows Server 2008 R2 domain | ||
| functional level by default. | ||
| If you plan to include only domain controllers that run | ||
| Windows Server 2008 R2 in the entire forest, you might | ||
| choose this forest functional level for administrative | ||
| convenience. If you do, you will never have to raise the | ||
| domain functional level for each domain that you create in | ||
| the forest. |
No comments:
Post a Comment