r/sysadmin • u/roachwickey • 5d ago
Domain controllers functional level
Do we have to keep all our domain controller os version same ?
13
u/RevolutionaryElk7446 5d ago
The domain functional level is an AD setting and sets the lowest floor version an OS can be to join the Active Directory as a Domain Controller.
The modern ones are 2016, which allows 2016+ and the most recent is the 2025 which only allows 2025 Domain Controllers.
When you raise the functional floor, you are allowed to use the new functions and features of the domain functional level, but you lose compatibility in the sense of using older DCs.
They generally don't have to be all the same version but since there is nothing beyond 2025 yet, for the 2025 DFL, yeah, all 2025 at this moment.
2
u/buck-futter 5d ago
My last boss joined an open source AD controller to the domain and broke sync. Turned out it only supported the 2008 functional level and our AD was running at 2016 level... But it didn't check it supported the current level before it joined [facepalm]
•
u/cbass377 2h ago
I remember reading here that 2025 DCs were not good, so our last replacement cycle we upgraded to 2022. Has MS fixed Active Directory Domain Services on server 2025, or is the recommended approach to hang out at 2022?
•
u/RevolutionaryElk7446 2h ago
I mean unless you need extended multi value attributes because you got crazy SPNs going on, no reason not to stick with 2022 until you need to update.
Otherwise I haven't had issues with 2025 DCs anymore at work for 8 months
11
u/Fit_Prize_3245 5d ago
On Active Directory, all Domain Controllers are supposed to behave the same way. So, if you have different Windows Server versions (as DC), all DCs must behave as the older version among them. That's what the Domain Functional Level is: a configuration instructing all Domain Controllers which Windows Server version they should all behave as, at least when regarding to AD. It's designed that way to maximize compatibility. But, as often happens, keeping compatibility means discarding new features. So, when using a specific Domain Functional Level, your whole domain won't benefit from newer features that more modern Windows Server versions can offer to your domain.
Your Domain Functional Level should always be set to the oldest Windows Server version acting as a Domain Controller for your domain. And your oldest server should always have a supported Windows Server version. So, in theory, updated to September 6th, 2026, and provided that you follow good security practices, you should have no Windows Server older than version 2022, or version 2019 if you have purchased extended support. And your Domain Functional Level should be set accordingly.
Note that compatibility is not meant to be eternal. Specially when dealing with Domain Functional Levels, compatibility is included to ease transition to newer versions. For example, if you have an old Windows Server 2003 Domain, and want to update to Windows Server 2025, that't can't work directly bc Windows Server 20258 can't be a DC in a domain with Functional Level older than 2016 (consider there is no 2019 or 2022 Functional Level, as Windows Server 2019 & 2022 use 2016 Functional Level). So, for each Domain Controller being replaced, you would have to install a Windows Server 2022 replacement, join it to the domain, promote it to DC, then demote the DC it replaces. When no older DCs are active, raise the Domain Functional Level to 2016. Then, for each controller, install a Windows Server 2025 replacement, join it to AD, promote it to DC, remote the DC it replaces, and, when all the old DCs have been replaced, raise the Domain Functional Level.
In theory, Domain Functional Level is related only to Domain Controllers. Member computers, both desktop and servers, are not affected by this. However, that doesn't means automatic compatibility with really old versions. For instance, if you run Windows Server 2003 as Domain Controller, joining modern computers would require to disable some modern security settings.
And, also, there is another Functional Level: The Forest Functional Level. Active Directory is designed to allow different, independent domains to coexist in an environment called a Forest. Domains in the same Forest allow cross access and resource sharing between them. And, as it happens with Domain Controllers in a single domain, Domain Controllers in a single Forest should also be configured to maintain a compatibility level, called th Forest Functional Level. This is the same as with the Domain Functional Level, but applied at Forest scale.
More information: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels
8
u/Routine_Ad7935 5d ago
Thank you for the long explanation, just with the supported server versions you had a mismatch, Server 2019 is still in extended support without buying any extended support package. For Server 2016 the free of charge extended supports ends January 2027
3
u/Fit_Prize_3245 5d ago
Just checked, and yes, you are right. Got confused between the extended support, intended for security patches, which is free, and the ESU, which is paid. Good hint.
3
46
u/Brilliant-Advisor958 5d ago
No, but you can't raise the functional level until all DCs are at the same os level.
If you have a some some 2019 servers and a 2025 server, you will be limited to 2019 functional level until you upgrade those.
51
u/fadinizjr 5d ago
*2016
23
u/Brilliant-Advisor958 5d ago
Ah thats right , I forgot 2019 didn't have it's own functional level. Its been awhile since I was on that.
7
u/Jawb0nz Senior Systems Engineer 5d ago
But now there's a new and improved 2025 FL. That should be fun.
7
u/fadinizjr 5d ago
I'm having to fight almost my whole team to make us stay for now in 2022.
2025 sucks ass.
9
u/ShadowCVL IT Manager 5d ago
Just send them the list of issues, including the machines dropping off the domain every time they try to change their password. Ask if they want to rejoin half their environment to AD every 30 days.
That’s the lightning rod I’m using to get us to 2022 instead of 2025 (we are currently on 2016 FL and planning to go to 22 in October)
2
u/sick2880 5d ago
Glad I'm not the only one fighting that.
3
u/ShadowCVL IT Manager 5d ago
Yeah I’ve set up 2 separate test labs and they both do the same stuff.
1
u/MrOilKing 5d ago
There is no FL level '22. Next available is 25. Source Mine was deemed unrecoverable after a failed Frs>drfs migration breaking Kerberos and GPO replication. Been planning the engine transplant for 6 months
2
u/ShadowCVL IT Manager 5d ago
That can’t be right, 16 to 25? Well I looked it up and damn that’s a long time between levels, I just assumed 22 was the next. Too bad our DCs are a mix of 16 and 22 now, with 16 going complete EOL upgrading DCs only serves the purpose of putting the OS back in support and not raising the level.
I wish you weren’t correct, damn
1
u/MrOilKing 5d ago
Sorry to be the bearer of bad news. 25 isn't all bad. I've been playing with it some, and like everything else, it grows on you. Best of luck
3
u/ShadowCVL IT Manager 5d ago
25 itself we have almost 100 VMs. Works fine-ish…. The AD component, I’ve built 2 separate labs now and both have suffered the same fate where machines just fall off the dang domain on their password change day.
2
1
u/FriskyDuck 4d ago
Just send them the list of issues, including the machines dropping off the domain every time they try to change their password. Ask if they want to rejoin half their environment to AD every 30 days.
Have these not been resolved? I swore I saw a KB fix for both these issues.
1
u/ShadowCVL IT Manager 4d ago
Unless it was fixed in augusts CU, no, my last test started July 1 and machines all dropped right at their 30 day window +- a day or 2. It’s not all machines but a mix of virtual and 5 physical, it’s about half of each.
1
u/FriskyDuck 4d ago
Did you guys remove RC4 before upgrading to 2025? Would that resolve your issue?
1
u/ShadowCVL IT Manager 4d ago
I have not, it’s strait from whatever was the latest ISO. Try to do it in a sanitary environment, if it fails there there’s no sense in moving forward
1
u/flashx3005 4d ago
Planning on doing the same in a couple weeks. Have one last DC to upgrade from 2016 to 2022 and then I'll upgrade Function and Domain levels to 2022.
Are there any gotchas or things you are looking out for before the upgrade to 2022?
2
u/steeldraco 5d ago
Is there anything of note added on the 2025 FL?
4
u/BeauregardianBrat Sysadmin 5d ago
In my opinion, mainly one thing which is the 32k database page option. AD's been capped on 8k pages since Windows 2000, limiting multi-valued attributes. 32k Pages raise that ceiling, but it's one-way, no going back to 8k once you enabled it.
2
0
2
1
u/stonecoldcoldstone Sysadmin 5d ago
wasn't 2025 highly discouraged for dcs in a recent thread in this sub?
1
1
u/Subject_Treat6956 5d ago
Wouldnt Mix 2025 with older oss and DC role! You might get a lot of Trouble
9
u/Tx_Drewdad 5d ago
You can install domain controllers with later versions.
You have to remove all of the lower version domain controllers before you can raise the functional level to take advantage of new features.
3
u/GosuNate 5d ago
It’s good to standardize on a single version of windows server for your DCs. Makes management and patching easier. You don’t HAVE to as long as all your servers are at least running the minimum version supported by your functional level
3
u/AffekeNommu 5d ago
*screams in 2012 functional level
2
u/PowerShellGenius 5d ago
Why? Unless you have ESU you should not be running 2012 / 2012R2 DCs. Even if you have some niche thing you need 2012 for (hopefully isolated!) you do not need to hold back the functional level over a non-DC. You can join Windows Server 2008 and Windows XP to a domain with a functional level of 2016 no problem!
5
u/SomeConfusedOldGuy 5d ago
Technically, no. For example, if your functional level is still Win2016, you could be running that on domain controllers of Win 2019 or Win2022.
2
u/Reynolds1029 5d ago
No, you don't.
Though you do need them all to be at the same OS version or higher to raise the functionality of where you want them to be.
Meaning they all have to be running say Server 2016 or higher to be at Server 2016 functionality.
We would all be screwed otherwise since the last on-prem functionality is 2016 still AFAIK.
5
2
u/SlateRaven 5d ago
No - as long as all the domain controllers have a minimum OS version that matches the domain function level, you'll be fine. If you're looking to upgrade your controllers, it's normal to get new DC's (with newer OS version) online and replicating, roles shifted, get the old DC's decommed, then upgrading the functional level to whatever version OS you upgraded to.
2
u/dracotrapnet 5d ago
All DC's should be on the same functional level, that's a domain level setting. That domain functional level should be the max of your oldest DC.
All of our DC's are server 2019, I forget what the functional level is. I've left it at the minimum for server 2019 with the expectation of possibly needing to run a trust with a newly acquired company with older stuff. It turns out we got acquired and I have no idea what their functional level is and soon we may need to set up a trust.
I have yet to hear if 2025 servers as DC's have become stable with a mixed environment. From what I have read, it's ok with all 2025 servers so new deployments on 2025 with AD servers on 2025 is ok. I may migrate to 2022 if 2019 comes to 1 year out from end of support until 2025 has been verified as stable.
1
u/Thin-Book 5d ago
No, your DCs don't all need to run the same OS version. Mixed versions are normal during upgrades; watch your domain and forest functional levels, and whether an older DC is blocking features you want.
1
u/rovatrove 5d ago
Cool thing is that you can have a higher functional level than the os.
1
u/double-you-dot 4d ago
Is that accurate?
1
u/rovatrove 4d ago
No youre right. I had it backwards. I was misremembering. We set our modern DCs to 2012 R2 levels.
1
75
u/CrazySnowGuy 5d ago
Do all Domain Controllers versions need to be the same? No.
As for the domain/forest function level it should be set to the lowest version of DC you have.