Pre-requisites

• The user account upgrading Domain Functional Level should need to be a part of Domain Admins

• The user account upgrading Forest Functional Level should need to be a part of Enterprise Admins

• All the Domain Controllers should have the Operating System same or later than the Domain Functional Level you are trying to upgrade to. For E.g: If you want to upgrade your Domain Functional Level to 2012 R2, All Domain Controllers should be either Windows Server 2012 R2 or higher.

• Once the Forest and Domain Functional Level is upgraded, there is no way to revert it back to previous version unless you have options to run Forest Recovery. Please note that this is a very tedious steps to revert back the Domain and Functional Functional Level, so plan out this activity thoroughly. I will write about this in more details in future posts

• There is no dependancy on Workstation or Domain Member Server Operating Systems on Domain or Forest Functional Level. Only Domain Controllers OS matters

High Level Steps

• Upgrade all your Domain Controllers Operating Systems to support the Domain Functional Level

• Upgrade the Domain Functional Level

• Upgrade the Forest Functional Level

Notes

• There are various new features enabled in each of the Domain and Forest Functional Level upgrade. Please refer to http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels(WS.10).aspx for more details on it

Challenges

• Even though you have made a list of all Active Domain Controllers and they meet the requirement of minimum OS Level, there could be few Domain Controllers which may have been demoted\decommissioned in the past and may not have proper metadata cleanup done which poses an obstacle while upgrading the Functional Level. You may receive below errors while trying to upgrade. Make sure all the stale Domain Controller entries are washed out before upgrading the Functional Level.

"You Cannot raise the domain functional level because this domain includes Active Directory Domain Controllers that are not running the appropriate version of Windows"

• Save the output file to note the Domain Controllers still below the required version of Windows Operating System. You may see a past demoted\decommissioned DC listed in the output and you may see this error listed against the Domain Controller

Unknown. The computer object may be damaged or missing

• Try clearing the Metadata of the Domain Controller to proceed with upgrading Domain & Forest Functional Level

Steps to upgrade Domain Functional Level

There are 2 method to upgrade DFL

Method 1: Using Active Directory Users and Computers

1. Logon to Domain Controller using an account with Domain Admin privileges
2. Go to Start -> Windows Administrative Tools -> Open Active Directory Users and Computers
3. Right Click on your domain name on the left
4. Click on Raise Domain Functional Level

Method 2: Using Active Directory Domains and Trusts

1. Logon to Domain Controller using an account with Domain Admin privileges
2. Go to Start -> Windows Administrative Tools -> Open Active Directory Domains and Trusts
3. Right Click on your domain name on the left
4. Click on Raise Domain Functional Level

Upgrade Forest Functional Level

1. Logon to Domain Controller using an account with Enterprise Admin privileges
2. Go to Start -> Windows Administrative Tools -> Open Active Directory Domains and Trusts
3. Right Click on "Active Directory Domains and Trusts" on the left
4. Click on Raise Forest Functional Level

If you have any questions or you need to add anything, please leave a comment.

Like my facebook page https://facebook.com/wintelspot

Active Directory is based on a Single Master Operations Roles. These roles can be hosted on different Windows Domain Controllers or a single Domain Controller can also hold all the roles. 

There are in-total 5 FSMO Roles. 2 are Forest-Wide Roles and 3 are Domain-Wide Roles.
i.e 2 roles are held by Domain Controller for entire Forest whereas Domain Roles are held by Domain Controllers in the Domain.

Forest Wide Roles:
Schema Master Role
Active Directory uses attributes to define various objects like Users and Computers. These attributes are used by various applications which depend on Active Directory like Exchange, Lync and many others. This role is responsible for updating any changes to the attributes to the Schema of the forest. These changes are irreversible and these changes are then replicated to other Domain Controllers in the Forest.

Domain Naming Master Role
This Role helps in validating the Domain Name Space in the Partitions container. This role helps in adding or removing a domain from the forest. It cross verifies a Domain name before adding it to the Forest. This role helps in writing in the Partitions container.


Domain Wide Roles:
PDC Emulator Operation Role
All the FSMO roles are equally important but PDC Emulator is considered to be the one which needs to be online and available at most times as it helps in Password sync and Time Synchronization within the Domain. This role helps in syncing the password for objects with it and replicates to the other Domain Controllers.
PDC Emulator also plays a vital role in Time Sync where there is Domain Hierarchy configuration is set. It syncs up with the external Time Source and other domain members syncs up with the PDC Emulator.

RID Master Role
This Role is responsible for providing SID Pools for the Domains which is needed for creating different AD objects like users and computers. This SID contains a Domain SID [which is common for all objects in the domain] plus RID [Relative ID] which is assigned to individual Objects

Infrastructure Master Role
The Infrastructure FSMO role owner is the DC responsible for updating a cross-domain object reference in the event that the referenced object is moved, renamed, or deleted. In this case, the Infrastructure Master role should be held by a domain controller that is not a GC server. If the Infrastructure Master runs on a GC server, it will not update object information, because it does not contain any references to objects that it does not hold. This is because a GC server holds a partial replica of every object in the forest. When an object in one domain is referenced by another object in another domain, it represents the reference as a dsname. If all the domain controllers in a domain also host the GC, then all the domain controllers have the current data, and it is not important which domain controller owns the Infrastructure Master (IM) role

AD Groups are an internal part of Active Directory provided for the ease of management of resources like User Accounts. Computer Accounts and other Service Accounts. AD Groups can be created to group together different resources so that the permissions can be provided without much hassles.

Imagine providing access to a list of users on a share or computer would be a troublesome and lengthy process. Managing them through groups is much more simpler and easy to document.

Security vs Distribution Groups

A) Security Groups

Security Groups is used to group together various AD Objects like Service Accounts, User Accounts and Computer Accounts etc in order to provide appropriate permissions on various Resources. These Groups can be helpful to segregate level of access provided. As the name suggests, these groups are primarily for security purpose

B) Distribution Groups

Distribution Groups can be created basically for Exchange related activities. Distribution Groups help us in adding various user accounts and sync them with Exchange \ Office365 components to receive\send emails to a set of users

>> The following segregation of a subset of Security Groups based on the level of scopes

Local vs Domain Local vs Global vs Universal

A) Local Groups

Local Groups are created on a local computer and their scope is only limited to a single computer. It could be created on any Windows machine and are not associated with Active Directory. However these groups can contain AD Users, AD Computers and even Local Users and Administrators.

Local Groups can contain Local Users, Domain Users, Computers, Domain Local Group, Global Group and Universal Group as members

B) Domain Local Groups

This group is created at Domain Level and their scope is limited within Domain.

It may contain Users, Computers, Domain Local Group. Global Group and Universal Group

C) Global Groups

Global Groups are created at Domain Level but they have Forest level scope and would be useful to extend the purview in other domains in the forest.

These Groups can have Users, Computers and Other Global Groups from the same Domain as members.

D) Universal Groups

Universal Groups are also created at Domain Level and have Forest level scope. That means these Groups can access resources from other Domains in the Forest.

The difference between Global and Universal Group is that Universal Groups can have members like Users, Computers and Other Universal Groups from multiple Domains in the forest as well

Windows Server Administrator has been rebooting Windows Servers all his life :P, either to troubleshoot ongoing issues or to complete the patching process or there could be several other reasons. During the server build process itself we need to restart the machine after joining the server to the Windows Domain.

In this post, I want to highlight an issue we basically come across where the authentication handshake with the Domain fails and users are unable to access the resources on the server using their Domain Accounts. The security relationship with the domain is broken, disallowing authentication of the server on the network. In this case, the administrator tries to check the network connectivity between the server and the Authenticating Domain Controller. In some cases, we need to re-join the server to the domain followed by a Server Reboot.

We can try running the below Powershell command on a Windows Server 2008 or higher OS machine to repair the secure channel between the server and Domain Controller. You would need to login to the server using the Local Account.

Test-ComputerSecureChannel –credential domainname\domainadminaccount –Repair