Understanding Domain and Forest Functionality

Windows 2000 native

Windows 2000 Server

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2003

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2008

Windows Server 2008

Windows Server 2008 R2

Windows Server 2008 R2

Windows Server 2008 R2

Windows 2000 native

All default Active Directory features and the following features:

• Universal groups are enabled for both distribution groups and security groups.
  
  
• Group nesting.
  
  
• Group conversion is enabled, which makes conversion possible between security groups and distribution groups.
  
  
• Security identifier (SID) history.
  
  

Windows Server 2003

All default Active Directory features, all features from the Windows 2000 native domain functional level, plus the following features:

• The availability of the domain management tool, Netdom.exe, to prepare for domain controller rename.
  
  
• Update of the logon time stamp. The lastLogonTimestamp attribute is updated with the last logon time of the user or computer. This attribute is replicated within the domain.
  
  
• The ability to set the userPassword attribute as the effective password on the inetOrgPerson object and user objects.
  
  
• The ability to redirect Users and Computers containers. By default, two well-known containers are provided for housing computer and user/group accounts: cn=Computers,<domain root> and cn=Users,<domain root>. This feature makes it possible to define a new well-known location for these accounts.
  
  
• Authorization Manager can store its authorization policies in AD DS.
  
  
• Constrained delegation is included, which makes it possible for applications to take advantage of the secure delegation of user credentials by means of the Kerberos authentication protocol. You can configure delegation to be allowed only to specific destination services.
  
  
• Selective authentication is supported, which makes it possible to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest.
  
  

Windows Server 2008

All default Active Directory features, all features from the Windows Server 2003 domain functional level, plus the following features:

• Distributed File System Replication support for SYSVOL, which provides more robust and detailed replication of SYSVOL contents.
  
  
• Advanced Encryption Services (AES 128 and 256) support for the Kerberos authentication protocol.
  
  
• Last Interactive Logon Information, which displays the time of the last successful interactive logon for a user, from what workstation, and the number of failed logon attempts since the last logon.
  
  
• Fine-grained password policies, which make it possible for password policies and account lockout policies to be specified for users and global security groups in a domain.
  
  

Windows Server 2008 R2

All default Active Directory features, all features from the Windows Server 2008 domain functional level, plus the following features:

• Authentication mechanism assurance, which packages information about the type of logon method (smart card or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorization based on a user’s logon method.
  
  

Windows 2000

Windows NT® 4.0

Windows 2000

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2003 (default)

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2008

Windows Server 2008

Windows Server 2008 R2

Windows Server 2008 R2

Windows Server 2008 R2

Windows Server 2003

All default Active Directory features, plus the following features:

• Forest trust
  
  
• Domain rename
  
  
• Linked-value replication (Changes in group membership store and replicate values for individual members instead of replicating the entire membership as a single unit.) This results in lower network bandwidth and processor usage during replication and eliminates the possibility of lost updates when different members are added or removed concurrently at different domain controllers.
  
  
• The ability to deploy a read-only domain controller (RODC) that runs Windows Server 2008.
  
  
• Improved Knowledge Consistency Checker (KCC) algorithms and scalability. The intersite topology generator (ISTG) uses improved algorithms that scale to support forests with a greater number of sites than can be supported at the Windows 2000 forest functional level.
  
  
• The ability to create instances of the dynamic auxiliary class called dynamicObject in a domain directory partition.
  
  
• The ability to convert an inetOrgPerson object instance into a User object instance, and the reverse.
  
  
• The ability to create instances of the new group types, called application basic groups and Lightweight Directory Access Protocol (LDAP) query groups, to support role-based authorization.
  
  
• Deactivation and redefinition of attributes and classes in the schema.
  
  

Windows Server 2008

This functional level provides all of the features that are available at the Windows Server 2003 forest functional level, but no additional features. All domains that are subsequently added to the forest, however, will operate at the Windows Server 2008 domain functional level by default.

Windows Server 2008 R2

All of the features that are available at the Windows Server 2003 forest functional level, plus the following features:

• Active Directory Recycle Bin, which provides the ability to restore deleted objects in their entirety while AD DS is running.
  
  

All domains that are subsequently added to the forest will operate at the Windows Server 2008 R2 domain functional level by default.

If you plan to include only domain controllers that run Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience. If you do, you will never have to raise the domain functional level for each domain that you create in the forest.