Forest functional level should be retrievable
AD-FOR-01InfoActive DirectoryDomain and forest
Part of Active Directory · Active Directory · Domain and forest · All checks
Invoke-Maester -TestId AD-FOR-01Overview
Section titled “Overview”The forest functional level determines which Active Directory features are available across all domains in the forest. Higher functional levels unlock important forest-wide security capabilities:
- Windows Server 2016+: Enables features like privileged access management (PAM) across the forest
- Windows Server 2012 R2+: Provides access to forest-wide authentication policies and silos
- Global Features: Some features require forest-wide consistency to function
- Security Posture: Running at lower levels means missing modern security features
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”Aim to maintain your forest at the highest functional level supported by all domain controllers:
- Verify Compatibility: Ensure all DCs in all domains support the target level
- Test Applications: Verify critical applications work at the higher level
- Plan Maintenance Window: Schedule the upgrade appropriately
- Document Changes: Record the upgrade for audit and compliance purposes
How the Test Works
Section titled “How the Test Works”This test retrieves the current forest functional level from Active Directory along with basic forest information including the root domain and domain count.
Related Tests
Section titled “Related Tests”Test-MtAdDomainFunctionalLevel- Retrieves the domain functional levelTest-MtAdForestDomainCount- Counts domains in the forest
Related links
Section titled “Related links”- Microsoft Learn: Active Directory Domain Services functional levels
- ANSSI Active Directory checkpoints: Insufficient forest and domains functional levels
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-FOR-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdForestFunctionalLevel |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:crossRef:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain/Test.AD-FOR-01.ps1 - Documentation:
tests/ad/domain/Test.AD-FOR-01.md