A quick guide to Active Directory Forest Functional Level

What are Functional Levels?

An Active Directory functional level determines what capabilities of Active Directory Domain Services (AD DS) are available for a particular forest or domain. The functional levels are specified in terms of Windows Server versions, as each version update brings with it a host of new AD DS functionalities. Functional levels have to be specified, because its functionalities are not backwards compatible with previous functional levels.

Functional levels are classified into two types:

  1. Forest functional level (FFL)
  2. Domain functional level (DFL)

Let’s focus on forest functional levels To learn more about domain functional levels, you can click here.

Forest functional level (FFL)

A forest functional level determines the functionalities of AD DS that are enabled in a forest. Raising an FFL increases the capabilities of all the domain controllers (DC) in the forest. For example, Windows Server 2016 brought Privileged Access Management (PAM) functionalities along with all the functionalities of the previous version.

Forest functional level also dictates the minimum functional level at which all DCs in the forest should operate. Any DC that runs on a lower version of Windows server will be demoted from the DC position. This restriction however, is only applicable to DCs. Member servers and work stations in the forest will remain unaffected.

You can view your forest functional level by following these steps:

  1. Go to Start and open Administrative Tools
  2. Go to Active Directory Domains and Trusts
  3. Right click on the root domain, and go to Properties
  4. Under the General tab, you will be able to see your forest and domain functional levels

Choosing your forest functional level

When deploying AD DS, you will be given the option to choose your forest functional level. When choosing the forest functional level, do note that the domain functional level should be the same as forest functional level, or higher. Any new domain that is added to this forest will take the forest functional level by default.

Changing your forest functional level

If at any point, you need to change the functional level of your forest, you can do so by following these steps:

  1. Go to Start and open Administrative Tools
  2. Go to Active Directory Domains and Trusts
  3. In the left pane, right click on Active Directory Domains and Trusts and select Raise Forest Functional Level.
  4. You will see a list of forest functional levels that are available. Select the required functional level and click Raise.

Things to note before raising your forest functional level

Raising your forest functional level gives your forest access to new and improved AD DS functionalities. However, there are also certain things to take care of before raising the functional level, so that all systems remain functional.

Firstly, you will have to ensure that all the DCs in the forest are running the same Windows server version as the forest functional level you intend to have, or higher. If not, identify those DCs, and either upgrade their Windows Server versions or demote them as necessary. You will also have to ensure that the domain functional level is the same or higher than the forest functional level you intend to have.

Secondly, check and ensure whether replication is working properly in your forest, as it is a crucial functionality that you don’t want to be broken.

Finally, to ensure a seamless transition to a higher forest functional level, verify whether all your organization’s enterprise applications and services are compatible with the forest functional level you intend to have.

These steps will ensure a smooth upgrade to the higher functional level of choice, and you will not have any nasty surprises after the upgrade process.

Accessible functionalities according to functional levels

A good practice before raising the forest functional level is to understand the functionalities that each functional level brings to the table, so that you can take an informed decision. Each functional level carries over the functionalities of the previous one, and adds additional functionalities on top. Some levels don’t introduce any major functionalities, while others bring massive improvements. To help you understand better, here is a split up of all functionalities that were introduced with each Windows Server version.

Comments

comments

1 Star2 Stars3 Stars4 Stars5 Stars (9 votes, average: 3.89 out of 5)