Skip to main content
Version: 2.2.1-preview

AD-DOM-01 - Domain functional level should be retrievable

Michael SouleAgnivesh S.Merill Fernando
Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview​

The domain functional level determines which Active Directory features are available in your domain. Higher functional levels unlock important security capabilities:

  • Windows Server 2016+: Enables features like privileged access management (PAM), temporary group membership, and enhanced authentication policies
  • Windows Server 2012 R2+: Provides access to claims-based authentication and compound authentication
  • Security Posture: Running at lower functional levels means missing modern security features that protect against contemporary attack vectors

Security Recommendation​

Aim to maintain your domain at the highest functional level supported by your domain controllers. Before raising the functional level:

  1. Verify all domain controllers are running a Windows Server version that supports the target level
  2. Test applications for compatibility with the higher functional level
  3. Plan the upgrade during a maintenance window
  4. Document the change and communicate to stakeholders

How the Test Works​

This test retrieves the current domain functional level from Active Directory and displays it along with basic domain information. The test is informational and helps you understand your current security capabilities.

  • Test-MtAdForestFunctionalLevel - Retrieves the forest functional level
  • Test-MtAdDomainControllerCount - Counts domain controllers in the domain

Test Metadata​

FieldValue
Test IDAD-DOM-01
SeverityMedium
SuiteActive Directory
CategoryAD.Domain
PowerShell testTest-MtAdDomainFunctionalLevel
TagsAD, AD-DOM-01, AD.Domain

Source​

  • Pester test: tests/ad/domain/Test-MtAdDomainFunctionalLevel.Tests.ps1
  • PowerShell source: powershell/public/ad/domain/Test-MtAdDomainFunctionalLevel.ps1