AD Functional Levels

Functional levels in AD are stored in an attribute named msDS-Behavior-Version. Depending on the object the attribute is attached to, it returns the functional level of the forest, domain or the capabilities of a domain controller.

This information can be used in a script, for example to verify if the forest or domain is in a certain mode or if you want to make sure there are no Windows 2003 controllers.

Note that when the value is missing, 0 is assumed.

Forest Functional Level
For the forest, you can determine the functional level by inspecting the msDS-Behavior-Version property of cn=partitions,cn=configuration,. For example, to find out the current forest functional level using PowerShell:


Domain Functional Level

For the domain, you can determine the functional level by inspecting the msDS-Behavior-Version property of . For example, to find out the current domain functional level:


Domain Controllers
To determine the (maximum) capabilities of a domain controller, inspect inspect the msDS-Behavior-Version property of cn=NTDS Settings,cn=,cn=servers,cn=sites,cn=configuration,.The class of the “NTDS Settings” object is NTDSDSA, which you can use to query the value for all domain controllers (sample script here).


DomainDomain Controller
020002000 Mixed / Native2000
12003 Interim2003 InterimN/A
42008 R22008 R22008 R2
62012 R22012 R22012 R2

3 thoughts on “AD Functional Levels

  1. Pingback: Retrieving DCs functional levels | EighTwOne (821)

  2. Pingback: Active Directory Schema Version | EighTwOne (821)

  3. Pingback: Windows Server 2012 RC Version and Levels | EighTwOne (821)

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.