How functional levels work

[Michael Adam]

On 2016-04-11 at 07:56 +0100, Rowland Penny wrote:
> On 11/04/16 06:31, Michael Adam wrote:
> >On 2016-04-10 at 20:29 +0100, Rowland Penny wrote:
> >>On 10/04/16 20:15, Andrew Bartlett wrote:
> >>>On Sun, 2016-04-10 at 12:11 +0100, Rowland Penny wrote:
> >>>>root at dc2000a:~# samba-tool domain level show
> >>>>Domain and forest function level for domain 'DC=samba,DC=test,DC=tld'
> >>>>
> >>>>Forest function level: (Windows) 2000
> >>>>Domain function level: (Windows) 2000
> >>>>Lowest function level of a DC: (Windows) 2008 R2
> >>>>
> >>>>OK, how can the only DC in a domain have a lowest function
> >>>>level that is higher than the domain or forest level ??
> >>>>or am I missing something ?
> >This says that there is no DC in the domain
> >(or forest?) that is of level lower than 2008 R2.
> >But the domain and forest are still configured to
> >only use 2000 level functionality, hence allowing
> >for older DCs. That is no contradiction:
> 
> Ah, light dawns (I think), when you say 'level lower than 2008 R2', this
> means 'The highest level of DC you can join is 2008 R2, but it will function
> as a 2000 server'.

Essentially, yes. The advanced features will only be
enabled once the domain (or forest) functional level
is raised.

See

https://technet.microsoft.com/en-us/library/cc787290%28v=ws.10%29.aspx

and

https://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx

Cheers - Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20160411/729c6f3c/signature.sig>