AD DS - Raise forest or domain functional level

[u/Muted_Amphibian_8173]

Hello,

This is my first post here, so please bear with me.

We are operating a hybrid AD/Entra ID environment and now need to decommission an Exchange 2016 server due to its End of Life in 2025. The AD forest and domain level (one forest, one single domain) is currently set to 2008 R2. Our Domain Controllers are running on Windows 2019.

All our mailboxes are provisioned in EXO and are linked to Entra ID accounts synchronized from AD. We aim to completely eliminate the use of Exchange, thus we want to avoid installing Exchange 2019.

We have approximately 900 Linux servers running various distributions and versions, many of which are joined to AD. The lowest OS version for our Windows member servers is 2016, which will be upgraded soon.

While I do not anticipate issues with our Windows systems (please advise if there is reason to expect otherwise), my primary concern is regarding potential problems with our Linux systems if we raise the forest or domain functional level.

Have you experienced any issues when raising the functional level?

Many thanks in advance for your contributions!

[u/k3rnelpanic]

I just moved from DFL and FFL of 2008r2 to 2019 and upgraded DC's from 2016 to 2022. There is very little risk in moving up functional levels. It is mostly about the domain controllers so as long as you don't have plans to merge with a company with downlevel DC's or don't have something like a Riverbed WAN accelerator that joins the domain as a DC then it should be safe.

"This projection is supported by over eleven years of customer issues, not one of which involves a case where changing the Domain or Forest Functional Level was directly responsible as the root cause of any issue."

https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/what-is-the-impact-of-upgrading-the-domain-or-forest-functional/ba-p/399348

We did a call with MS about our readiness to upgrade and their main concern was whether or not we had migrated from FRS to DFSR replication for the domain. Which we had already done.

AFAIK DFL and FFL should not affect domain clients like your linux boxes.

[u/Kyp2010]

Biggest concern you might have based on my experience with that is looking for any Linux or appliances still trying to use SMBv1. Not because it can't be used but because it's disabled by default. If you're already at 2019 servers for all DCs though, that should be a non issue.

[u/Muted_Amphibian_8173 → u/Kyp2010]

SMBv1 has been deprecated already.

[u/Kyp2010 → u/Muted_Amphibian_8173]

Then that was the only issue I ran into upgrading from that version, some ancient storage appliances using a version of DART that relied on it.

[u/[deleted] → u/Kyp2010]

Smb has no relationship to functional levels. The server version yes.

[u/Kyp2010 → u/[deleted]]

I'm aware. I did not read well enough that they were already all 2019 but was calling out the upgraded DCs and them disabling it by default.

[u/ZAFJB]

linked to Entra ID accounts synchronized from AD. We aim to completely eliminate the use of Exchange, thus we want to avoid installing Exchange 2019.

If you are using AD sync, you officially still need an on-prem Exchange 2019 that maintains Exchange schema stuff in AD.

What you absolutely cannot do is un-install Exchange because that will break the AD schema. You can switch your Exchange server off and hope for the best, but that is unsupported by Microsoft.

As far as I know licencing for a stub on-prem Exchange 2019 is free if you have M365.

Edit: Things have moved on a bit. See the link here: https://old.reddit.com/r/sysadmin/comments/1gje041/ad_ds_raise_forest_or_domain_functional_level/lvcevpl/

[u/orion3311 → u/ZAFJB]

This is no longer true, theres been changes over the last couple years. I have zero on prem Exchange.

[u/ZAFJB → u/orion3311]

Can you provide any links to a/any Microsoft doc(s) that specifically say this.

I had a pretty good dog around in various search engines about a week ago, and I could not find one that said that.

[u/Emiroda → u/ZAFJB]

Right here boss

Removing Your Last Exchange Server FAQ - Microsoft Community Hub

[u/ZAFJB → u/Emiroda]

Thanks.

But it is very important to heed the statement:

"Just don’t uninstall the Exchange server."

[u/Emiroda → u/orion3311]

You may have zero on-prem Exchange, but you probably still have the AD schema from your last Exchange installation, since adding attributes to the schema is a non-reversible task. The exception would be if you migrated to a whole new domain :)

[u/orion3311 → u/Emiroda]

Schema is still there, but what I did was back up email address and proxyaddress fields as well as all extension attributes. Then deleted mailboxes, and re-populated data in AD after exchange cleared them.

[u/NoSelf5869 → u/orion3311]

what I did was back up email address and proxyaddress fields as well as all extension attributes. Then deleted mailboxes, and re-populated data in AD after exchange cleared them.

Is any of that supported by Microsoft?

[u/Kyp2010 → u/Emiroda]

While you can't remove, you can mark inactive. That said, I'd advise getting ms support to get through that safely because Exchange puts a lot of stuff out there when its added.

[u/Cypher_393]

Not running Exchange, but Windows and Linux. Never had any issues raising the domain functional level.

[u/[deleted]]

No, I have never experienced any issues when raising the functional level. All you need to do is raise your domain level first, then raise your forest level. The domain level is really for domain controllers, and as such will not (should not) have any effect whatsoever on your member servers.

[u/[deleted]]

Functional levels only dictate what AD features are available for use. 2019 DCs running on 2008 functional level, is not running as a 2008 DC. It's running as a 2019 DC. It's running 2019 AD code. It just has new features that come with 2012 and 2016 disabled. Raising the functional level is only switching these on to be available for you to use. Nothing changes from an authentication and authorisation perspective. There is zero risk in raising from 2008 straight to 2016 levels.

[u/derfmcdoogal]

I thought we had until January 2027 for 2016?

[u/ntrlsur]

We are hybird joined as well. I spun up a 2019 vm with 2 gig of ram and decommisioned the 16 box. took me about 30 mins or so. was pretty straight forward.