With each new release of Windows Server come new sets of features related to the domain and forest functional levels in your Active Directory domain. The table below outlines the differences in domain and forest functional levels between Windows 2000, Windows 2003 and Windows 2008.
| Domain functional level |
Available features |
Supported domain controller operating systems |
| Windows 2000 native |
All of the default AD DS features and the following directory features are available:· Universal groups for both distribution and security groups.· Group nesting· Group conversion, which allows conversion between security and distribution groups· Security identifier (SID) history |
· Windows 2000· Windows Server 2003· Windows Server 2008 |
| Windows Server 2003 |
All the default AD DS features, all the features that are available at the Windows 2000 native domain functional level, and the following features are available:· The domain management tool, Netdom.exe, which makes it possible for you to rename domain controllers· Logon time stamp updates
The lastLogonTimestamp attribute is updated with the last logon time of the user or computer. This attribute is replicated within the domain.· The ability to set the userPassword attribute as the effective password on inetOrgPerson and user objects· The ability to redirect Users and Computers containers
By default, two well-known containers are provided for housing computer and user accounts, namely, cn=Computers,<domain root> and cn=Users,<domain root>. This feature allows the definition of a new, well-known location for these accounts.· The ability for Authorization Manager to store its authorization policies in AD DS· Constrained delegation
Constrained delegation makes it possible for applications to take advantage of the secure delegation of user credentials by means of Kerberos-based authentication.
You can restrict delegation to specific destination services only.· Selective authentication
Selective authentication makes it is possible for you to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest. |
· Windows Server 2003· Windows Server 2008 |
| Windows Server 2008 |
All of the default AD DS features, all of the features from the Windows Server 2003 domain functional level, and the following features are available:· Distributed File System (DFS) replication support for the Windows Server 2003 System Volume (SYSVOL)
DFS replication support provides more robust and detailed replication of SYSVOL contents.· Advanced Encryption Standard (AES 128 and AES 256) support for the Kerberos protocol· Last Interactive Logon Information
Last Interactive Logon Information displays the following information:· The time of the last successful interactive logon for a user· The name of the workstation that the used logged on from· The number of failed logon attempts since the last logon
· Fine-grained password policies
Fine-grained password policies make it possible for you to specify password and account lockout policies for users and global security groups in a domain. For more information, see Step-by-Step Guide for Fine-Grained Password and Account Lockout Policy Configuration |
· Windows Server 2008 |
| Forest functional level |
Available features |
Supported domain controllers |
| Windows 2000 native |
All of the default AD DS features are available. |
· Windows Server 2008· Windows Server 2003· Windows 2000 |
| Windows Server 2003 |
All of the default AD DS features, and the following features are available:· Forest trust· Domain rename· Linked-value replication
Linked-value replication makes it possible for you to change group membership to store and replicate values for individual members instead of replicating the entire membership as a single unit. Storing and replicating the values of individual members uses less network bandwidth and fewer processor cycles during replication, and prevents you from losing updates when you add or remove multiple members concurrently at different domain controllers.· The ability to deploy a read-only domain controller (RODC)· Improved Knowledge Consistency Checker (KCC) algorithms and scalability
The intersite topology generator (ISTG) uses improved algorithms that scale to support forests with a greater number of sites than AD DS can support at the Windows 2000 forest functional level. The improved ISTG election algorithm is a less-intrusive mechanism for choosing the ISTG at the Windows 2000 forest functional level.· The ability to create instances of the dynamic auxiliary class named dynamicObject in a domain directory partition· The ability to convert an inetOrgPerson object instance into a User object instance, and to complete the conversion in the opposite direction· The ability to create instances of new group types to support role-based authorization.
These types are called application basic groups and LDAP query groups.· Deactivation and redefinition of attributes and classes in the schema |
· Windows Server 2003· Windows Server 2008 |
| Windows Server 2008 |
All of the features that are available at the Windows Server 2003 forest functional level, but no additional features are available. All domains that are subsequently added to the forest, however, operate at the Windows Server 2008 domain functional level by default. |
· Windows Server 2008 |
Guidelines for raising domain and forest functional levelsThe following guidelines apply to raising the domain or forest functional levels:
- You must be a member of the Domain Admins group to raise the domain functional level.
- You must be a member of the Enterprise Admins group to raise the forest functional level.
- You can raise the domain functional level on the primary domain controller (PDC) emulator operations master only. The AD DS administrative tools that you use to raise the domain functional level (the Active Directory Domains and Trusts snap-in and the Active Directory Users and Computers snap-in) automatically target the PDC emulator when you raise the domain functional level.
- You can raise the forest functional level on the schema operations master only. Active Directory Domains and Trusts automatically targets the schema operations master when you raise the forest functional level.
- You can raise the functional level of a domain only if all domain controllers in the domain run the version or versions of Windows that the new functional level supports.
- You can raise the functional level of a forest only if all domain controllers in the forest run the version or versions of Windows Server operating system that the new functional level supports.
- You cannot set the domain functional level to a value that is lower than the forest functional level.
- You cannot lower the domain or forest functional level after you have raised it.
- You cannot reverse the operation of raising the domain and forest functional levels. If you have to revert to a lower functional level, you must rebuild the domain or forest, or restore it from a backup copy.