Active Directory

Understanding Domain and Forest Functionality

Domain and forest functional Level

Domain and forest functionality

Domain and forest functionality, which is available in Windows Server® 2008 Active Directory Domain Services (AD DS), provides a way to enable domain-wide features or forest-wide Active Directory features in your network environment.

Different levels of domain functionality and forest functionality are available, depending on your network environment. If all the domain controllers in your domain or forest are running Windows Server 2008 or Microsoft® Windows Server® 2003 and the domain and forest functional level is set to Windows Server 2008 or Windows Server 2003, all domain-wide features and forest-wide features are available.

When Microsoft Windows® 2000 domain controllers are included in your domain or forest with domain controllers running Windows Server 2008 or Windows Server 2003, Active Directory features are limited. For more information about how to enable domain-wide features or forest-wide features, see Raise the Domain Functional Level and Raise the Forest Functional Level.

Please see this article to check the domain and forest functional level of active directory.

Domain functionality

Domain functionality enables features that affect the entire domain and that domain only. In Windows Server 2008 AD DS, three domain functional levels are available: Windows 2000 native (the default), Windows Server 2003, and Windows Server 2008. The following table lists the domain functional levels and their corresponding supported domain controllers:

Domain functional levelDomain controllers supported
Windows 2000 nativeWindows 2000 Windows Server 2003 Windows Server 2008
Windows Server 2003Windows Server 2003 Windows Server 2008
Windows Server 2008Windows Server 2008

When you raise the domain functional level, domain controllers running earlier operating systems cannot be introduced into the domain. For example, if you raise the domain functional level to Windows Server 2003, you cannot add domain controllers running Windows 2000 Server to the domain. If you raise the domain functional level to Windows Server 2008, you cannot add domain controllers running Windows Server 2003 to the domain. The following table describes the domain-wide features that are enabled for the Windows Server 2008 AD DS domain functional levels.

Domain functional levelEnabled features
Windows 2000 nativeAll default Active Directory features and the following features:
  • Universal groups are enabled for both distribution groups and security groups.
  • Group nesting.
  • Group conversion is enabled, which makes conversion possible between security groups and distribution groups.
  • Security identifier (SID) history.
Windows Server 2003All default Active Directory features, all features from the Windows 2000 native domain functional level, plus the following features:
  • The availability of the domain management tool, Netdom.exe, to prepare for domain controller rename.
  • Update of the logon time stamp. The lastLogonTimestamp attribute is updated with the last logon time of the user or computer. This attribute is replicated within the domain.
  • The ability to set the userPassword attribute as the effective password on the inetOrgPerson object and user objects.
  • The ability to redirect Users and Computers containers. By default, two well-known containers are provided for housing computer and user/group accounts: cn=Computers,<domain root> and cn=Users,<domain root>. This feature makes it possible to define a new well-known location for these accounts.
  • Authorization Manager can store its authorization policies in AD DS.
  • Constrained delegation is included, which makes it possible for applications to take advantage of the secure delegation of user credentials by means of the Kerberos authentication protocol. You can configure delegation to be allowed only to specific destination services.
  • Selective authentication is supported, which makes it possible to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest.
Windows Server 2008All default Active Directory features, all features from the Windows Server 2003 domain functional level, plus the following features:
  • Distributed File System Replication support for SYSVOL, which provides more robust and detailed replication of SYSVOL contents.
  • Advanced Encryption Services (AES 128 and 256) support for the Kerberos authentication protocol.
  • Last Interactive Logon Information, which displays the time of the last successful interactive logon for a user, from what workstation, and the number of failed logon attempts since the last logon.
  • Fine-grained password policies, which make it possible for password policies and account lockout policies to be specified for users and global security groups in a domain.

Forest functionality

Forest functionality enables features across all the domains in your forest. Three forest functional levels are available: Windows 2000 (default), Windows Server 2003 interim, and Windows Server 2003. By default, forests operate at the Windows 2000 functional level. You can raise the forest functional level to Windows Server 2003 or Windows Server 2008. The following table lists the forest functional levels and their corresponding supported domain controllers.

Forest functional levelDomain controllers supported
Windows 2000 (default)Windows 2000 Windows Server 2003 Windows Server 2008
Windows Server 2003Windows Server 2003 Windows Server 2008
Windows Server 2008Windows Server 2008

When you raise the forest functional level, domain controllers running earlier operating systems cannot be introduced into the forest. For example, if you raise the forest functional level to Windows Server 2003, domain controllers running Windows 2000 Server cannot be added to the forest. The following table describes the forest-wide features that are enabled for the Windows 2000, Windows Server 2003, and Windows Server 2008 forest functional levels.

Forest functional levelEnabled features
Windows 2000All default Active Directory features.
Windows Server 2003All default Active Directory features, plus the following features:
  • Forest trust
  • Domain rename
  • Linked-value replication (Changes in group membership store and replicate values for individual members instead of replicating the entire membership as a single unit.) This results in lower network bandwidth and processor usage during replication and eliminates the possibility of lost updates when different members are added or removed concurrently at different domain controllers.
  • The ability to deploy a read-only domain controller (RODC) that runs Windows Server 2008.
  • Improved Knowledge Consistency Checker (KCC) algorithms and scalability. The intersite topology generator (ISTG) uses improved algorithms that scale to support forests with a greater number of sites than can be supported at the Windows 2000 forest functional level.
  • The ability to create instances of the dynamic auxiliary class called dynamicObject in a domain directory partition.
  • The ability to convert an inetOrgPerson object instance into a User object instance, and the reverse.
  • The ability to create instances of the new group types, called application basic groups and Lightweight Directory Access Protocol (LDAP) query groups, to support role-based authorization.
  • Deactivation and redefinition of attributes and classes in the schema.
Windows Server 2008This functional level provides all of the features that are available at the Windows Server 2003 forest functional level, but no additional features. All domains that are subsequently added to the forest, however, will operate at the Windows Server 2008 domain functional level by default.

So, that’s all in this blog. I will meet you soon with next stuff .Have a nice day !!!

Recommended contents

How to Check the Active Directory Database Integrity

Disabling and Enabling the Outbound Replication

DFS Replication Service Stopped Replication

What is Strict Replication Consistency

The replication operation failed because of a schema mismatch between the servers involved

Troubleshooting ad replication error 8418 the replication operation failed because of a schema mismatch between the servers

How to export replication information in txt file

Repadmin Replsummary

Enabling the outbound replication

Disabling and enabling replication on schema master domain controller

How to enable strict replication consistency

How to prevent lingering objects replication in active directory

AD replication process overview

How to force active directory replication

Change notification in replication process

How to check replication partner for a specific domain controller

dcdiag test replications

Guys please don’t forget to like and share the post.Also join our WindowsTechno Community and where you can post your queries/doubts and our experts will address them .

You can also share the feedback on below windows techno email id.

If you have any questions feel free to contact us on admin@windowstechno.com also follow us on facebook@windowstechno to get updates about new blog posts.

How useful was this post?

Click on a star to rate it!

As you found this post useful...

Follow us on social media!

Was this article helpful?
YesNo

Vipan Kumar

He is an Active Directory Engineer. He has been working in IT industry for more than 10 years. He is dedicated and enthusiastic information technology expert who always ready to resolve any technical problem. If you guys need any further help on subject matters, feel free to contact us on admin@windowstechno.com Please subscribe our Facebook page as well website for latest article. https://www.facebook.com/windowstechno

Leave a Reply

Back to top button