Raising Domain Functional Level from 2008 to 2016. Do domain joined devices need to match as well as DCs?

[-]

frac6969@reddit

Correct. Only DC matters. We still have some XP joined to the domain. Luckily they’re finally being phased out within the next few months.

Reply

[-]

Sasataf12@reddit

Say what you want about MS, gotta respect them for their commitment to backwards compatibility.

Reply

[-]

Often don't have a choice. I am pretty sure we still have a lot of legacy on prem services still being maintained due to government contracts. For example, the navy was still paying microsoft millions to keep extending their support contract for windows xp.

Reply

[-]

pdp10@reddit

It's funny because the U.S. Navy was one of the first big organizations to deploy lots of NT, before NT 4.0 even. They weren't slow and conservative then. [It showed.](https://en.wikipedia.org/wiki/USS_Yorktown_(CG-48)#Smart_ship_testbed) It's what computists sometimes call a ["roach motel"](https://en.wikipedia.org/wiki/Roach_Motel#:~:text=The%20widely%20known%20tagline%20of,information%20technology).

Reply

[-]

LarryInRaleigh@reddit

Aha! Does anyone besides me remember the USS Yorktown debacle in July, 1998 (a quarter-century ago)? The USS Yorktown, an Aegis Missile Cruiser, was the Navy's first "Smart Ship." Everything was controlled by a Windows NT 4.0 computer. The plan was to reduce manpower, maintenance, and costs. But on the first sailing, the software crashed, and restarts resulted in the same crash. Ultimately the Navy had to send another ship to tow the Yorktown to port. The skeptics said "NT stands for Needs Towing." After two days in port, the problem was determined to be a "Divide by Zero" fault that didn't have error handling. Full details: [https://gcn.com/1998/07/software-glitches-leave-navy-smart-ship-dead-in-the-water/290995/](https://gcn.com/1998/07/software-glitches-leave-navy-smart-ship-dead-in-the-water/290995/)

Reply

[-]

woodburyman@reddit

As of 2012-2014 some Ohio class subs still ran NT4 internally on some control systems.

Reply

[-]

kona420@reddit

27 years later still as true as ever, "Unix is a better system for control of equipment and machinery, whereas NT is a better system for the transfer of information and data. NT has never been fully refined "

Reply

[-]

pdp10@reddit

It's funny because the U.S. Navy was one of the first big organizations to deploy lots of NT, before NT 4.0 even. They weren't slow and conservative then. [It showed.](https://en.wikipedia.org/wiki/USS_Yorktown_(CG-48)#Smart_ship_testbed) It's what computists sometimes call a ["roach motel"](https://en.wikipedia.org/wiki/Roach_Motel#:~:text=The%20widely%20known%20tagline%20of,information%20technology).

Reply

[-]

woodburyman@reddit

... As the Kerberos changes made between November 2022 and now block everything pre-Windows 7 and 2008 R2 from network aurh. (ass only). .. We have one Server 2003 system in production were desperately still moving away from..

Reply

[-]

papyjako89@reddit

They wouldn't have a business if they didn't tho.

Reply

[-]

pdp10@reddit

Microsoft breaks backward compatibility in a heartbeat when they think it will make them more money, going back to the 1990s at least. A great many of the times they've kept backward compatibility with one of their rushed implementations from the past, has resulted in major infosec vulnerabilities. But they made more money by being compatible, so those times they were compatible. It shows at the code level. There's some crufty code throughout the products that never gets touched, even if it needs some change. And there's code that gets rewritten even if it's perfectly fine, because Microsoft needs to show more Xbox advertisements on the enterprise desktop. The products are suffering for it, but this has been the fate of big computing vendors once their original growth strategies stop working.

Reply

[-]

stonecoldcoldstone@reddit

if you're a school you might need to speak with your MIS provider, Sims for example can't run above 2019 if you plan to gradually work up to 2022

Reply

[-]

SextupleConcentrate@reddit (OP)

Thankfully not in a school - CAPITA SIMS scares me too much.

Reply

[-]

JDH201@reddit

You should be fine, but it may be worth checking that you aren’t running FRS still. Someone before you may forgot to do the FRS to DFS migration if this was ever upgraded from a pre 2008 directory.

Reply

[-]

Sasataf12@reddit

FRS should be already removed if the active DCs are on 2019.

Reply

[-]

JDH201@reddit

Yep, that’s why I said should be fine.

Reply

[-]

kliman@reddit

It won’t actually let you do the function level upgrade past 2016 unless the FRS upgrade is completed (in my experience, anyway)

Reply

[-]

woodburyman@reddit

Pa's 2016? Isn't 2016 the highest function level?

Reply

[-]

R4LRetro@reddit

This. I did this earlier last year and realized we were still using FRS. However, it was pretty simple to migrate to DFSR. As long as dcdiag shows a healthy domain, you can do the Express or Hyper migration guides outlined here: https://techcommunity.microsoft.com/t5/storage-at-microsoft/streamlined-migration-of-frs-to-dfsr-sysvol/ba-p/425405 DO NOT just do the steps one after the other. You will want to make sure each state is reached when you do dfsrmig /getmigrationstate. I migrated my DCs in a day without issues, good luck!

Reply

[-]

kona420@reddit

Best part of raising the functional level is that there is no going back.

Reply

[-]

dcdiagfix@reddit

From 2008 r2 you can roll back dfl and ffl upgrades

Reply

[-]

kona420@reddit

Learn something new everyday. Thank you.

Reply

[-]

Ok_Presentation_2671@reddit

I have a DC running Windows Server 2012 R2 and can’t wait till I can upgrade it. So do I need to upgrade to 2016 first then move to 2022?

Reply

[-]

Entegy@reddit

There is no 2022 domain functional level. So you can jump straight to Windows Server 2022, then migrate to the 2016 functional level.

Reply

[-]

kona420@reddit

Should be no issue joining a 2022 DC to even a 2008 functional level domain. No rush on functional level either unless you actually want one of the handful of new features. It's a pretty short list. Biggest jump in the last half dozen versions was 2012 to 2012 r2, the way DFSR worked in 2012 was pathologically bad. You're already on R2 so the change will probably be less dramatic. Just my 2 cents, everyones experience is going to be a little different especially regarding technical debt.

Reply

[-]

iama_bad_person@reddit

I recently raised a DC from 2008 to 2016 (please don't ask) and apart from the absolutely convoluted process of how to do that, we did not have any problems with our domain joined computers. Then again they are all Windows 10, latest build (god I hope so).

Reply

[-]

dcdiagfix@reddit

You should not “upgrade” dcs, you should build new and repromote which in itsself is a very simple process.

Reply

[-]

TaliesinWI@reddit

Apparently in-place DC upgrades are "acceptable" according to Microsoft now. Scares the hell out of me, I'll never do it. I can clone my 2019 template and promote it faster than it takes to run the upgrade on older DCs.

Reply

[-]

AtarukA@reddit

Non-issue if it's just a DC. Just that since it's just a DC, you may as well just rebuild. But I never had issues in the past with just upgrading the DC precisely because it's just a DC. I'll still move FSMO roles and everything away first though.

Reply

[-]

TaliesinWI@reddit

I'm old enough to remember when in-place upgrades for DCs were \_very\_ unsupported (and frankly not a fantastic idea for \_any\_ server, although obviously you could do it) and old habits die hard. :)

Reply

[-]

dcdiagfix@reddit

I wouldn’t be brave enough to do that in prod… might try in my lab though!

Reply

[-]

Gorby_45@reddit

Agreed. Just in stall new DC’s and demote the old. Did that all my 20 years in IT.

Reply

[-]

iama_bad_person@reddit

We did that in the end once we got approval to just spin up another DC, we were just trying to not ask for approval and see if we could do it.

Reply

[-]

PaulJCDR@reddit

What was the convoluted process? Right click, select new level and OK is all I've ever had to do?

Reply

[-]

crane476@reddit

If it was on 2008, there's a chance it was still using FRS instead of DFSR replication. Upgrading that is a slightly more complicated than just raising the domain functional level.

Reply

[-]

Blazedout419@reddit

I assume you had to use a temporary 2012R2 to get to 2016? I also removed an 2008 DC recently (don’t ask) and went to 2022 after.

Reply

[-]

SextupleConcentrate@reddit (OP)

Thanks. I know your pain. Killing this old RODC seems to have been the most convoluted part so far but I'm sure more pain lies ahead.

Reply

[-]

selltekk@reddit

Make sure you don’t have any 2003 servers.

Reply

[-]

vane1978@reddit

You can have legacy 2003 servers on the network, but not join to the domain. Correct?

Reply

[-]

selltekk@reddit

Yeah. The big issue is NTLMv1 and SMBv1

Reply

[-]

vane1978@reddit

The challenge I’m having is how to backup a small MS Access database from the 2003 server.

Reply

[-]

selltekk@reddit

Just get it off the 2”03 server and put it on a fileshare that not on an OS that’s 20 years old

Reply

[-]

vane1978@reddit

It’s easier said than done.

Reply

[-]

selltekk@reddit

Yeah. I know it is

Reply

[-]

RiceeeChrispies@reddit

Ooo, I’m actually doing this soon and this passed me by. As long as SMBv1 is enabled, it will continue to work - no? Either way, great excuse to finally tell the business the server is dead.

Reply

[-]

selltekk@reddit

What you’ll run into is that domain koined2003 servers won’t be able to access SYSVOL and NETLOGON which is problematic. Enabling SMBv1 is a bad idea.

Reply

[-]

RiceeeChrispies@reddit

Oh yeah, for sure. If it’s not running anything requiring domain services, disconnecting it and isolating it further is probably the best way forward besides the obvious decomm. Damn, I hate LoB applications.

Reply

[-]

ryan8613@reddit

I recommend giving this article a read: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels#windows-server-2016-functional-levels

Reply

[-]

drkmccy@reddit

If you have demoted the old DC,you can safely raise it.

Reply

[-]

SextupleConcentrate@reddit (OP)

I haven't unfortunatley because it still works as a file/print server and is in use. All methods of doing that seem to delete the object from the domain so I need to re-join it but it will probably need a different hostname which raises more issues with GPOs that point to it etc.

Reply

[-]

Ok_Presentation_2671@reddit

Separate as many roles as you can from AD, I would only suggest AD, DNS, DHCP. That keeps it impact from being a Spof

Reply

[-]

gorgoleon29@reddit

Have you tried running dcpromo on it? If you delete the object from AD you can safely rejoin it with same hostname, no problems there

Reply

[-]

SextupleConcentrate@reddit (OP)

Yeah. Because the Active Directory Domain Services role was removed it doesn't recognise itself as a DC anymore. So when you run dcpromo it just goes through the usual setup screen rather than giving you the option to demote gracefully. Yet AD still thinks it's an RODC.

Reply

[-]

ComGuards@reddit

> Yet AD still thinks it's an RODC. Where are you checking this? The computer object being stuck in the DC OU is not necessarily a good indicator. Did you check Event Viewer | Directory Service for errors and criticals? Does Sites & Services still show it with active links?

Reply

[-]

SextupleConcentrate@reddit (OP)

It has always appeared as offline with no active links since I've been here. Even though it is on and connected to the domain. Will review event viewer as well.

Reply

[-]

TheJessicator@reddit

Sounds like you're making changes to the replication topology without first ensuring the health of the replication technology. If anything is out of sync, fix that first. And after each change, make sure the changes have synced across the whole forest before moving forward. You can help things along by forcing replication repeatedly (and I mean repeatedly... Once or twice is not enough, because each successive party of the change requires the previous part to have synced.

Reply

[-]

drkmccy@reddit

Sounds like it wasn’t demoted properly. Add domain services again, promote it, then demote it again? Or you can try and force remove it from AD then join the domain again. Unless you are getting rid of the roles, you’re gonna have to move the FS and PS role to a new 2022 VM anyway so might as well start doing that

Reply

[-]

SextupleConcentrate@reddit (OP)

You're probably right. I'm certain I ticked the option to demote but it definitely hasn't done. Since then I have had to manually install kb4490628 before it would allow any updates to apply. It's now fully up to date (or as much as 2008 can be). So I will try promote it and demote it via dcpromo.

Reply

[-]

PaulJCDR@reddit

You are right, your functional level depends on lowest OS level of yours DCs. So in your example, 2016 is the highest FFL and DFL you can select. Saying that, 2016 is the highest level anyway. Server 2019 and 2022 active directory didn't add any new features that required a new functional level. Members in the domain don't need to be of that level. Function levels only tell DCs what new feature they are allowed to use now. You need these for consistent user experience. You can't get features from one DC and then go to a different one and it not be available. So when all DCs are at the same level, we can expect the same feature set from them all. This setting tells them all now you are allowed to offer these features. It's only an inter DC setting. Zero impact on devices, apps etc.

Reply

[-]

DaMiBu@reddit

It's always backward compatible so typically very safe to proceed. I have personally done a lot of these and have never seen any fallout.

Reply

[-]

SextupleConcentrate@reddit (OP)

Thanks. That sounds good. Now I just have task of convincing the boss to murder the borked 2008 RODC (unfortunately it's also working as a file/print server). Is the general recommendation still to raise functional and then after raise forest to match?

Reply

[-]

DaMiBu@reddit

Your boss sounds like if it's not broke let's not fix it! Show him/her the list of security vulnerabilities with a 2008 server (especially as a FS) and it might help make your case. Have you already upgraded from FRS to DFRS?

Reply

[-]

SextupleConcentrate@reddit (OP)

Pretty much but we're getting somewhere now. Partner org has a security incident so there's much more pressure now to harden things. Need to verify if FRS is in use. Good point.

Reply

[-]

DaMiBu@reddit

Have you done a FRS to DFSR upgrade before? There are loads of docs out there so just follow exactly and give yourself at least 1-2 hours after hours to complete. (Most of the time is waiting for changes to replicate).

Reply

[-]

SextupleConcentrate@reddit (OP)

I haven't but to memory we are DFSR. Will check tomorrow and if FRS is in use I'll have some reading to do.

Reply

[-]

drkmccy@reddit

Sounds like it wasn’t demoted properly. Add domain services again, promote it, then demote it again? Or you can try and force remove it from AD then join the domain again. Unless you are getting rid of the roles, you’re gonna have to move the FS and PS role to a new 2022 VM anyway so might as well start doing that

Reply to Post

67 Comments