Wednesday, June 04, 2014

Active Directory Forest and Domain Levels

 

Features that are available at domain functional levels

The following table shows the features that are available at each domain functional level.

Domain functional level

Available features

Supported domain controller operating systems

Windows 2000 native

All of the default AD DS features and the following directory features are available:

Universal groups for both distribution and security groups.

Group nesting

Group conversion, which allows conversion between security and distribution groups

Security identifier (SID) history.

Note In Windows Server 2008 R2, the Personal Virtual Desktop feature was introduced. It requires the Windows 2000 native domain functional level

Windows Server 2008 R2

Windows Server 2008

Windows Server 2003

Windows 2000

Windows Server 2003

All the default AD DS features, all the features that are available at the Windows 2000 native domain functional level, and the following features are available:

The domain management tool, Netdom.exe, which makes it possible for you to rename domain controllers

Logon time stamp updates
The lastLogonTimestamp attribute is updated with the last logon time of the user or computer. This attribute is replicated within the domain.

The ability to set the userPassword attribute as the effective password on inetOrgPerson and user objects

The ability to redirect Users and Computers containers. By default, two well-known containers are provided for housing computer and user accounts, namely, cn=Computers,<domain root> and cn=Users,<domain root>. This feature allows the definition of a new, well-known location for these accounts.

The ability for Authorisation Manager to store its authorisation policies in AD DS

Constrained delegation
Constrained delegation makes it possible for applications to take advantage of the secure delegation of user credentials by means of Kerberos-based authentication.
You can restrict delegation to specific destination services only.

Selective authentication
Selective authentication makes it is possible for you to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest.

Windows Server 2012 R2

Windows Server 2012

Windows Server 2008 R2

Windows Server 2008

Windows Server 2003

Windows Server 2008

All of the default AD DS features, all of the features from the Windows Server 2003 domain functional level, and the following features are available:

Distributed File System (DFS) replication support for the Windows Server 2003 System Volume (SYSVOL)

Last Interactive Logon Information
Fine-grained password policies
Personal Virtual Desktops

Windows Server 2012 R2

Windows Server 2012

Windows Server 2008 R2

Windows Server 2008

Windows Server 2008 R2

All default Active Directory features, all features from the Windows Server 2008 domain functional level, plus the following features:

Authentication mechanism assurance, which packages information about the type of logon method (smart card or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorisation based on a user’s logon method.

Automatic SPN management for services running on a particular computer under the context of a Managed Service Account when the name or DNS host name of the machine account changes.

Windows Server 2012 R2

Windows Server 2012

Windows Server 2008 R2

Windows Server 2012

The KDC support for claims, compound authentication, and Kerberos armoring KDC administrative template policy has two settings (Always provide claims and Fail unarmored authentication requests) that require Windows Server 2012 domain functional level.

Windows Server 2012 R2

Windows Server 2012

Windows Server 2012 R2

DC-side protections for Protected Users. Protected Users authenticating to a Windows Server 2012 R2 domain can no longer:

Authenticate with NTLM authentication

Use DES or RC4 cipher suites in Kerberos pre-authentication

Be delegated with unconstrained or constrained delegation

Renew user tickets (TGTs) beyond the initial 4 hour lifetime

Authentication Policies (forest-based Active Directory)

Authentication Policy Silos

Windows Server 2012 R2

 

Features that are available at forest functional levels

The following table shows the features that are available at each forest functional level.

Forest functional level

Available features

Supported domain controllers

Windows 2000

All of the default AD DS features are available.

Windows Server 2008 R2

Windows Server 2008

Windows Server 2003

Windows 2000

Windows Server 2003

All of the default AD DS features, and the following features, are available:

Forest trust

Domain rename

Linked-value replication
(change group membership replicate values for individual members instead of replicating the entire membership )

The ability to deploy a read-only domain controller (RODC)

Improved Knowledge Consistency Checker (KCC) algorithms and scalability

The ability to create instances of the dynamic auxiliary class named dynamicObject in a domain directory partition

The ability to convert an inetOrgPerson object instance into a User object instance, and to complete the conversion in the opposite direction

The ability to create instances of new group types to support role-based authorisation.
These types are called application basic groups and LDAP query groups.

Deactivation and redefinition of attributes and classes in the schema. The following attributes can be reused: ldapDisplayName, schemaIdGuid, OID, and mapiID.

Domain-based DFS namespaces running in Windows Server 2008 Mode, which includes support for access-based enumeration and increased scalability.

Windows Server 2012 R2

Windows Server 2012

Windows Server 2008 R2

Windows Server 2008

Windows Server 2003

Windows Server 2008

All of the features that are available at the Windows Server 2003 forest functional level, but no additional features are available. All domains that are subsequently added to the forest, however, operate at the Windows Server 2008 domain functional level by default.

Windows Server 2012 R2

Windows Server 2012

Windows Server 2008 R2

Windows Server 2008

Windows Server 2008 R2

All of the features that are available at the Windows Server 2003 forest functional level, plus the following features:

Active Directory Recycle Bin, which provides the ability to restore deleted objects in their entirety while AD DS is running.

All domains that are subsequently added to the forest will operate at the Windows Server 2008 R2 domain functional level by default.

If you plan to include only domain controllers that run Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience. If you do, you will never have to raise the domain functional level for each domain that you create in the forest.

Windows Server 2012 R2

Windows Server 2012

Windows Server 2008 R2

Windows Server 2012

All of the features that are available at the Windows Server 2008 R2 forest functional level, but no additional features.

All domains that are subsequently added to the forest will operate at the Windows Server 2012 domain functional level by default.

Windows Server 2012 R2

Windows Server 2012

Windows Server 2012 R2

All of the features that are available at the Windows Server 2012 forest functional level, but no additional features.

All domains that are subsequently added to the forest will operate at the Windows Server 2012 R2 domain functional level by default.

Windows Server 2012 R2

 

Guidelines for raising domain and forest functional levels

The following guidelines apply to raising the domain or forest functional levels:

You must be a member of the Domain Admins group to raise the domain functional level.

You must be a member of the Enterprise Admins group to raise the forest functional level.

You can raise the domain functional level on the primary domain controller (PDC) emulator operations master only. The AD DS administrative tools that you use to raise the domain functional level (the Active Directory Domains and Trusts snap-in and the Active Directory Users and Computers snap-in) automatically target the PDC emulator when you raise the domain functional level.

You can raise the forest functional level on the schema operations master only. Active Directory Domains and Trusts automatically targets the schema operations master when you raise the forest functional level.

You can raise the functional level of a domain only if all domain controllers in the domain run the version or versions of Windows Server that the new functional level supports.

You can raise the functional level of a forest only if all domain controllers in the forest run the version or versions of Windows Server that the new functional level supports.

You cannot set the domain functional level to a value that is lower than the forest functional level, but you can set it to a value that is equal to or higher than the forest functional level.

With versions of Windows Server that are earlier than Windows Server 2008 R2, you cannot roll back or lower a functional level under any circumstances. If you have to revert to a lower functional level with a version of Windows Server that is earlier than Windows Server 2008 R2, you must rebuild the domain or forest or restore it from a backup copy.

After you set the domain functional level, you cannot roll back or lower the domain functional level except in the cases listed in the following table. The domain functional level can be lowered only by using Windows PowerShell.

Current domain functional level

Current forest functional level

Rollback options

Windows Server 2012 R2

Windows Server 2012 R2

None unless you first lower forest functional level

Windows Server 2012 R2

Windows Server 2012

Windows Server 2012

Windows Server 2012 R2

Windows Server 2008 R2

Windows Server 2012 or Windows Server 2008 R2

Windows Server 2012 R2

Windows Server 2008

Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008

Windows Server 2012

Windows Server 2012

None unless you first lower forest functional level

Windows Server 2012

Windows Server 2008 R2

Windows Server 2008 R2

Windows Server 2012

Windows Server 2008

Windows Server 2008 R2 or Windows Server 2008

Windows Server 2008 R2

Windows Server 2008 R2

None unless you first lower forest functional level

Windows Server 2008 R2

Windows Server 2008

Windows Server 2008

Windows Server 2008 or lower

Windows Server 2008 or lower

None

After you set the forest functional level, you cannot roll back or lower the forest functional level except in the cases listed in the following table. The forest functional level can be lowered only by using Windows PowerShell.

 

Current forest functional level

Recycle Bin enabled?

Rollback options

Windows Server 2012 R2

Yes

Windows Server 2012 or Windows Server 2008 R2

Windows Server 2012 R2

No

Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2

Windows Server 2012

Yes

Windows Server 2008 R2

Windows Server 2012

No

Windows Server 2008 R2 or Windows Server 2008

Windows Server 2008 R2

Yes

None

Windows Server 2008 R2

No

Windows Server 2008

 

Source material: http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels(v=ws.10).aspx

No comments:

Blog Archive