# Domain functional level should be retrievable

The domain functional level determines which Active Directory features are available in your domain.

Source: https://maester.dev/docs/tests/AD-DOM-01

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Domain and forest · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DOM-01
```

## Overview

The domain functional level determines which Active Directory features are available in your domain. Higher functional levels unlock important security capabilities:

- **Windows Server 2016+**: Enables features like privileged access management (PAM), temporary group membership, and enhanced authentication policies
- **Windows Server 2012 R2+**: Provides access to claims-based authentication and compound authentication
- **Security Posture**: Running at lower functional levels means missing modern security features that protect against contemporary attack vectors

#### Control Type

**Preventive**

#### Security Recommendation

Aim to maintain your domain at the highest functional level supported by your domain controllers. Before raising the functional level:

1. Verify all domain controllers are running a Windows Server version that supports the target level
2. Test applications for compatibility with the higher functional level
3. Plan the upgrade during a maintenance window
4. Document the change and communicate to stakeholders

#### How the Test Works

This test retrieves the current domain functional level from Active Directory and displays it along with basic domain information. The test is informational and helps you understand your current security capabilities.

#### Related Tests

- `Test-MtAdForestFunctionalLevel` - Retrieves the forest functional level
- `Test-MtAdDomainControllerCount` - Counts domain controllers in the domain

#### Related links

- [Microsoft Learn: Active Directory Domain Services functional levels](https://learn.microsoft.com/windows-server/identity/ad-ds/active-directory-functional-levels)
- [ANSSI Active Directory checkpoints: Insufficient forest and domains functional levels](https://www.cert.ssi.gouv.fr/uploads/ad_checklist.html#vuln_functional_level)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DOM-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdDomainFunctionalLevel](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-01.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS.name:ReadProperty |

</details>

## Source

- Test: [`tests/ad/domain/Test.AD-DOM-01.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-01.ps1)
- Documentation: [`tests/ad/domain/Test.AD-DOM-01.md`](https://github.com/maester365/maester/blob/main/tests/ad/domain/Test.AD-DOM-01.md)