AD Functional Levels

Functional levels in AD are stored in an attribute named msDS-Behavior-Version. Depending on the object the attribute is attached to, it returns the functional level of the forest, domain or the capabilities of a domain controller.

This information can be used in a script, for example to verify if the forest or domain is in a certain mode or if you want to make sure there are no Windows 2003 controllers.

Note that when the value is missing, 0 is assumed.

Forest Functional Level
For the forest, you can determine the functional level by inspecting the msDS-Behavior-Version property of cn=partitions,cn=configuration,<Forest DN>. For example, to find out the current forest functional level using PowerShell:

([ADSI]“LDAP://cn=partitions,cn=configuration,dc=contoso,dc=local”).get(“MSDS-Behavior-Version”)

Domain Functional Level

For the domain, you can determine the functional level by inspecting the msDS-Behavior-Version property of <Domain DN>. For example, to find out the current domain functional level:

([ADSI]“LDAP://dc=contoso,dc=local”).get(“MSDS-Behavior-Version”)

Domain Controllers
To determine the (maximum) capabilities of a domain controller, inspect inspect the msDS-Behavior-Version property of cn=NTDS Settings,cn=<Server Name>,cn=servers,cn=sites,cn=configuration,<Forest DN>.The class of the “NTDS Settings” object is NTDSDSA, which you can use to query the value for all domain controllers (sample script here).

Levels

msDS-Behavior-Version Forest
Domain Domain Controller
0 2000 2000 Mixed / Native 2000
1 2003 Interim 2003 Interim N/A
2 2003  2003 2003
3 2008  2008  2008
4 2008 R2  2008 R2  2008 R2
5 2012 2012 2012

3 thoughts on “AD Functional Levels

  1. Pingback: Retrieving DCs functional levels | EighTwOne (821)

  2. Pingback: Active Directory Schema Version | EighTwOne (821)

  3. Pingback: Windows Server 2012 RC Version and Levels | EighTwOne (821)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s