Domain functional level should be retrievable
AD-DOM-01InfoActive DirectoryDomain and forest
Part of Active Directory · Active Directory · Domain and forest · All checks
Invoke-Maester -TestId AD-DOM-01Overview
Section titled “Overview”The domain functional level determines which Active Directory features are available in your domain. Higher functional levels unlock important security capabilities:
- Windows Server 2016+: Enables features like privileged access management (PAM), temporary group membership, and enhanced authentication policies
- Windows Server 2012 R2+: Provides access to claims-based authentication and compound authentication
- Security Posture: Running at lower functional levels means missing modern security features that protect against contemporary attack vectors
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”Aim to maintain your domain at the highest functional level supported by your domain controllers. Before raising the functional level:
- Verify all domain controllers are running a Windows Server version that supports the target level
- Test applications for compatibility with the higher functional level
- Plan the upgrade during a maintenance window
- Document the change and communicate to stakeholders
How the Test Works
Section titled “How the Test Works”This test retrieves the current domain functional level from Active Directory and displays it along with basic domain information. The test is informational and helps you understand your current security capabilities.
Related Tests
Section titled “Related Tests”Test-MtAdForestFunctionalLevel- Retrieves the forest functional levelTest-MtAdDomainControllerCount- Counts domain controllers in the domain
Related links
Section titled “Related links”- Microsoft Learn: Active Directory Domain Services functional levels
- ANSSI Active Directory checkpoints: Insufficient forest and domains functional levels
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DOM-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDomainFunctionalLevel |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS.name:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain/Test.AD-DOM-01.ps1 - Documentation:
tests/ad/domain/Test.AD-DOM-01.md