Win Server 2008 Directory Services, Windows Server 2008 Functional Levels Overview
March 14, 2008
In the first part of our new series providing overview of Windows Server 2008-based Directory Services, we have concentrated on earlier implementations of Active Directory and their functionality. We have decided to use this approach to give you better understanding of benefits associated with new and improved features incorporated into the latest operating system platform. Our presentation was structured around Windows 2000 domain modes as well as Windows Server 2003 domain and forest functional levels, which organize functionality available across various combinations of the three major consecutive server versions (Windows NT 4.0 Server, Windows 2000 Server and Windows Server 2003).
In this article, we will focus on impact of introducing Windows Server 2008 into these arrangements and its consequences in terms of resulting functional levels.
There are two important factors to consider when evaluating most appropriate transition methodology. The first one is the restriction, which precludes a direct upgrade from Windows NT 4.0 or 2000 Server. For such operation, you need to run at least Windows Server 2003 SP1. In the context of Active Directory, this implies there is no Windows Server 2008 equivalent of Windows Server 2003 Interim level, which resulted from upgrading Windows NT 4.0 Server Primary Domain Controller to Windows Server 2003 operating system. The second consideration involves the inability of Windows Server 2008 domain controllers and Windows NT 4.0 BDCs to coexist in the same domain which eliminates possibility of promoting Windows Server 2008 to a domain controller in a Windows 2000 mixed-mode or Windows Server 2003 Interim functional level domains. It can, however, operate in a Windows Server 2003 Interim functional level forest, as long as it is part of a Windows Server 2003 functional level domain.
Collectively, these two restrictions mean that you will need to either decommission or upgrade all Windows NT 4.0 Server domain controllers (which should not surprise you, since this version of the server operating system reached its end of life over two years ago) to Windows 2000 or 2003 Server platform before you attempt to run the DCPromo on any of your newly installed Windows Server 2008 systems. The exception, of course, being if you are planning on setting up a new domain. In other words, Windows 2000 mixed mode domain and Windows Server 2003 Interim domain functional level are not permitted if Windows Server 2008 is to be introduced into Active Directory domain as one of its domain controllers. It is important to remember that these limitations do not apply in any way to running Windows Server 2008 computers as domain members in any of legacy environments.
Effectively, with the advent of the latest server operating system platform the total number of possible domain and forest functional levels in which Windows Server 2008 domain controllers can participate remains the same (when compared with equivalent Windows Server 2003 listing). Two entries have been removed from it (Windows 2000 Server mixed-mode domain and Windows Server 2003 Interim domain functional levels) and two were added (Windows Server 2008 domain and forest functional levels), yielding the following. Although, in essence, each corresponding feature set does not change, you can take advantage of variety of improvements introduced in Windows Server 2008-based domain controllers:
Note that it is possible to set up Windows Server 2008 functional level domains in a forest operating on any of the levels listed above. This brings the question about significance of assigning Windows 2008 forest functional level. While the consistency is likely its biggest strength (and, paradoxically also the weakness, since, as you might recall, this is non-reversible operation, preventing you from incorporating earlier versions of the operating system into Directory Services infrastructure), some caveats make its implementation worth considering. For example, to increase confidentiality of data stored in Active Directory, starting with Windows Server 2008, it is possible to limit set of attributes that will replicate to Read Only domain controllers. However, this restrictions can be circumvented by forcing replication with a Windows Server 2003 domain controller, which is not aware of this functionality. By enforcing the version of the operating system on domain controllers across entire forest you can eliminate this potential vulnerability. We will be pointing out other, similarly less obvious benefits throughout the course of our series.
On the other hand, note that having Windows Server 2008 based domain controllers offers a number of advantages even when operating in a mixed environment. Restartable Active Directory Domain Services (which allows you to place Active Directory in "offline" state on a particular domain controller without shutting down the operating system, increasing this way uptime and simplifying operations such as offline defragmentation), Read Only Domain Controllers (intended for deployment of Active Directory infrastructure to branch offices, which commonly lack properly secured data centers), improved auditing (providing you with useful, previously unavailable details regarding changes to AD objects and attributes), optimized Installation from Media process (further streamlining and securing the process of installing additional domain controllers in a domain with minimum impact on bandwidth during initial replication) are just some of the features, which become available following the first installation of a Windows Server 2008 domain controller in a domain, without the need for switching to Windows Server 2008 functional level (even though, their scope might be limited).
Our next article will present more detailed review of each of these features, including the steps involved in their implementation.