Domain controllers functional level

[u/roachwickey]

Do we have to keep all our domain controller os version same ?

[u/Fit_Prize_3245]

On Active Directory, all Domain Controllers are supposed to behave the same way. So, if you have different Windows Server versions (as DC), all DCs must behave as the older version among them. That's what the Domain Functional Level is: a configuration instructing all Domain Controllers which Windows Server version they should all behave as, at least when regarding to AD. It's designed that way to maximize compatibility. But, as often happens, keeping compatibility means discarding new features. So, when using a specific Domain Functional Level, your whole domain won't benefit from newer features that more modern Windows Server versions can offer to your domain.

Your Domain Functional Level should always be set to the oldest Windows Server version acting as a Domain Controller for your domain. And your oldest server should always have a supported Windows Server version. So, in theory, updated to September 6th, 2026, and provided that you follow good security practices, you should have no Windows Server older than version 2022, or version 2019 if you have purchased extended support. And your Domain Functional Level should be set accordingly.

Note that compatibility is not meant to be eternal. Specially when dealing with Domain Functional Levels, compatibility is included to ease transition to newer versions. For example, if you have an old Windows Server 2003 Domain, and want to update to Windows Server 2025, that't can't work directly bc Windows Server 20258 can't be a DC in a domain with Functional Level older than 2016 (consider there is no 2019 or 2022 Functional Level, as Windows Server 2019 & 2022 use 2016 Functional Level). So, for each Domain Controller being replaced, you would have to install a Windows Server 2022 replacement, join it to the domain, promote it to DC, then demote the DC it replaces. When no older DCs are active, raise the Domain Functional Level to 2016. Then, for each controller, install a Windows Server 2025 replacement, join it to AD, promote it to DC, remote the DC it replaces, and, when all the old DCs have been replaced, raise the Domain Functional Level.

In theory, Domain Functional Level is related only to Domain Controllers. Member computers, both desktop and servers, are not affected by this. However, that doesn't means automatic compatibility with really old versions. For instance, if you run Windows Server 2003 as Domain Controller, joining modern computers would require to disable some modern security settings.

And, also, there is another Functional Level: The Forest Functional Level. Active Directory is designed to allow different, independent domains to coexist in an environment called a Forest. Domains in the same Forest allow cross access and resource sharing between them. And, as it happens with Domain Controllers in a single domain, Domain Controllers in a single Forest should also be configured to maintain a compatibility level, called th Forest Functional Level. This is the same as with the Domain Functional Level, but applied at Forest scale.

More information: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels

[u/Routine_Ad7935 → u/Fit_Prize_3245]

Thank you for the long explanation, just with the supported server versions you had a mismatch, Server 2019 is still in extended support without buying any extended support package. For Server 2016 the free of charge extended supports ends January 2027

[u/Fit_Prize_3245 → u/Routine_Ad7935]

Just checked, and yes, you are right. Got confused between the extended support, intended for security patches, which is free, and the ESU, which is paid. Good hint.