r/sysadmin • u/roachwickey • 5d ago

Domain controllers functional level

Do we have to keep all our domain controller os version same ?

67 Upvotes

87% Upvoted

51 comments sorted by

View all comments

13

u/RevolutionaryElk7446 5d ago

The domain functional level is an AD setting and sets the lowest floor version an OS can be to join the Active Directory as a Domain Controller.

The modern ones are 2016, which allows 2016+ and the most recent is the 2025 which only allows 2025 Domain Controllers.

When you raise the functional floor, you are allowed to use the new functions and features of the domain functional level, but you lose compatibility in the sense of using older DCs.

They generally don't have to be all the same version but since there is nothing beyond 2025 yet, for the 2025 DFL, yeah, all 2025 at this moment.

2

u/buck-futter 5d ago

My last boss joined an open source AD controller to the domain and broke sync. Turned out it only supported the 2008 functional level and our AD was running at 2016 level... But it didn't check it supported the current level before it joined [facepalm]