Raising the Functional Levels

Introduction

The Active Directory (AD) functional levels determine the domain or forest capabilities. For details, see:

• Understanding Active Directory Domain Services (AD DS) Functional Levels

• What is the Impact of Upgrading the Domain or Forest Functional Level?

If you raise any of the functional levels, you will need to restart the Samba AD DC(s).

Supported Functional Levels

You can set the following functional levels in Active Directory (AD) via samba-tool.

Functional Level	Included in Samba Version
2016	4.20 and later
2012_R2	4.19 and later
2012	4.19 and later
2008_R2	4.0 and later
2008	4.0 and later
2003	4.0 and later

Group managed service accounts are still in the works server side but client side they are available in 4.20.

For more information on higher functional levels please read the release notes for 4.19, 4.20 and newer.

Raising the Domain Functional Level

Using samba-tool

To raise the domain functional level on a Samba Active Directory (AD) domain controller (DC), use samba-tool. For example, to set the domain functional level to 2008_R2:

# samba-tool domain level raise --domain-level=2008_R2

For a list of supported domain functional levels, see Supported Functional Levels.

Using the Windows Active Directory Domains and Trusts Utility

Raising the domain functional level using the Active Directory Domains and Trusts utility is currently not supported.
For details, see https://bugzilla.samba.org/show_bug.cgi?id=10360

Run the following steps on a Windows machine having the remote server administration tools (RSAT) installed:

• Log in as domain administrator.

• Open the Active Directory Domains and Trusts utility.

• Right-click the domain on the left side and select Raise Domain Functional Level.

• Select the functional level.

• Click OK.

Raising the Forest Functional Level

Using samba-tool

You can not set the forest functional level higher than the domain functional level.

To raise the forest functional level on a Samba Active Directory (AD) domain controller (DC), use samba-tool. For example, to set the forest functional level to 2012_R2:

# samba-tool domain level raise --forest-level=2012_R2

For a list of supported forest functional levels, see Supported Functional Levels.

Using the Windows Active Directory Domains and Trusts Utility

Raising the domain functional level using the Active Directory Domains and Trusts utility is currently not supported.
For details, see https://bugzilla.samba.org/show_bug.cgi?id=10360

Run the following steps on a Windows machine having the remote server administration tools (RSAT) installed:

• Log in as domain administrator.

• Open the Active Directory Domains and Trusts utility.

• Right-click Active Directory Domains and Trusts on the left side and select Raise Forest Functional Level.

• Select the functional level.

• Click OK.

---