Active Directory functional levels are control mechanisms that regulate which advanced features can be used within an enterprise domain. These functional levels specifically determine the domain and forest features of an organization’s Active Directory Domain Services (AD DS), which is usually comprised of domain controllers running on various versions of the Microsoft Windows Server operating system. Active Directory functional levels are selected when a new forest is deployed, allowing administrators to set the forest and domain functional levels. The domain functional level can be set higher than the forest functional level, but not the other way around.
The primary purpose of functional levels is to control which Windows Server OS versions can run domain controllers within a domain or forest. However, it does not limit the OS versions that can run on nodes joined to the domain or forest. Typically, the highest or latest functional level allows AD domain controllers to provide the largest suite of features and functions. Each newer AD version released with a Windows Server OS is backward-compatible but adds capabilities and features only available when all the domain controllers within the forest or domain are operating at the same OS functional level.
Centralization, global authorization and authentication, and simplified resource management are the three main functions of Active Directory. AD is fundamentally a hierarchical database that stores, organizes, and manages information about computers and user accounts attached to a network. It is most commonly associated with AD DS, which is the most used AD service. Centralization is one of the primary benefits of AD, providing admins with a single enterprise-wide mechanism to manage and secure network objects and resources while ensuring security for those assets.
AD provides logon control and management for access to network resources within the domain, thereby providing global authorization and authentication. Users are authenticated once using a single sign-on approach, enabling them to access resources for which their account, group, or role is authorized. Resource management is simplified because AD can be searched, allowing for fast and easy resource location. Users can locate published or visible resources and securely access those resources as needed.
The latest functional level offers several benefits, including a larger suite of features and functions. Each new functional level is backward-compatible and adds capabilities and features only available when all domain controllers within the forest or domain are operating at the same functional level. For example, Windows Server 2008 R2 adds the AD Recycle Bin, which allows admins to restore deleted objects from the AD database. However, this change requires all domain controllers to run Windows Server 2008 R2.
While it’s possible to operate a mixed environment with domain controllers running at a lower or older functional level, the features of the higher functional level are disabled until all domain controllers are upgraded to operate at the higher functional level. After upgrading all domain controllers in the domain or forest, administrators can raise the AD functional level, allowing certain features to be enabled. However, once an AD functional level is raised, it could be difficult or impossible to roll back without rebuilding the domain or restoring it from a backup.
The primary difference between a domain functional level and a forest functional level is scope. A domain is a logical grouping of objects within a single network domain, while a forest is a collection of two or more domains organized to represent an entire enterprise. A domain functional level defines the functional level selected for all AD domain controllers within the given domain. Similarly, forest functional level selection sets the features and functionality of AD DS across the entire forest.
In conclusion, Active Directory functional levels are crucial control mechanisms that determine which advanced features can be used in an enterprise domain. They help to regulate the domain and forest features of an organization’s AD DS, allowing administrators to set the forest and domain functional levels during deployment. The latest functional level provides the largest suite of features and functions. However, upgrading functional levels can cause complications; as such, administrators should only do so after carefully considering the implications.