Failed to Raise Forest Function Level

Currently 3 domain controllers in single domain.  2 servers Windows 2008 R2, 1 server Windows 2008 Standard.
The domain functional level is currently Windows 2008.  In the Ad Administrative Center, there is option to raise Forest Function level.  It was Win2003.  I initiated the Raise Forest Function Level to Win2008 and it failed.

This is the message when I go back to the "Raise the Forest Function:

"To raise the forest functional level, ensure that all domain controllers in the forest are running appropriate versions of Windows Server and there are no domains in the forest with a domain functional level set to Windows 2000 mixed."

I don't have any Windows 2000 or 2003 domain controllers.  There is one lowly Win2k3 member server still operating. I know that we converted to mixed mode when we were at w2k and wk3.  However, the same screen shows the Forest Function Level at Windows 2008.  How do I verify what the Forest Function level is?
Failed.FFL.JPG
cobmoIT ManagerAsked:
Who is Participating?
 
it_saigeConnect With a Mentor DeveloperCommented:
First you need to validate your Domain Functional Level:In 'Active Directory Domains and Trusts', right-click on your Domain and choose 'Properties'.The properties page will show you both the Domain and Forest Functional Level.In order to raise your Forest Functional Level, first ensure that your Domain Functional Level is *at least* Windows 2003 and that you don't have any Windows 2003 Servers in your domain (which you have stipulated that you do not).

https://technet.microsoft.com/library/understanding-active-directory-functional-levels(WS.10).aspx

You will also want to make sure that you don't have any Windows 2003 Domain Controllers left in the metadata for AD.



-saige-
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
What is the error message that you are getting? Have you checked to ensure that your AD replicaiton is working properly?

repadmin /replsum
repadmin /showrepl

Will.
0
 
Hypercat (Deb)Commented:
A few simple things to look at:

1.  Check AD Sites and Services/Sites/Default-First-Site-Name (or other site name(s)) and make sure that there aren't any old objects left in there from DCs that have been decommissioned/removed from service.

2.  You can also check using adsiedit and again make sure that there aren't any old orphaned server objects left around that might be causing the error.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
cobmoIT ManagerAuthor Commented:
In checking the Domain properties, I see it indicates the correct version (see attachment). I thought maybe I hadn't given it enough time to replicate but its been several hours on a small domain (125 users).

I checked the Domain Controllers (dcdiag /a) before I started.  I ran the replication commands and all is fine that I can tell.

AD Sites and Services only shows the 3 domain controllers.  Is there a way I can see any detailed residue?  I have had DCs in the past but have always demoted before removing from network.

Remember, I do have a Win2k3 MEMBER server still in use but understand this process affects DCs only from my research.

We started this domain with NT.  The domain name was CITY.  When we started using the FQDN the domain became CITY.STATE.US.

In the user account profiles, I still see the names that say pre-Windows 2000.  We originally used just the last name (CITY\smith).  With the introduction of email, all new users became CITY.STATE.US\tsmith.  Does the pre-Windows reference need to be deleted?  This might be a separate issue but it seems to just linger in the user configs and Im not sure that hangs domain changes up.
Domain-Properties.JPG
userprofile2.jpg
0
 
it_saigeDeveloperCommented:
Correct, member servers/computers are not considered by this process, only Domain Controllers.  The pre-Windows reference does not need to be deleted.  From the information you have posted so far, your Domain and Forest Functional Levels are correct for your current DC landscape (1 Windows Server 2008 R2 DC and 2 Windows Server 2008 DC's).

I would run a dcdiag just to be safe.

-saige-
0
 
Seth SimmonsSr. Systems AdministratorCommented:
You can't raise the functional level higher than the lowest domain controller operating system version.

Your original post states you have 3 domain controllers - 1 2008 and 2 2008 R2.

Your screenshot shows the functional level as 2008.  You can't raise it to 2008 R2 because you have a 2008 domain controller.  Once that 2008 domain controller is demoted, that leaves you with only 2008 R2 domain controllers - then you can raise the functional level to 2008 R2.

So yes, I would expect that error message if you try to raise the functional level as-is.
0
 
it_saigeDeveloperCommented:
Seth he reported that he was raising from 2003 to 2008...

-saige-
0
 
MaheshArchitectCommented:
Before attempting to raise functional levels

Check if any domain controller has public dns IP is defined under tcp/ip dns settings under preferred \ secondary, remove it, restart netlogon and dns service

Ensure no stale DC exists in metadata
ensure that references to FRS or DFS Replication Member Object are correct

Move all your FSMO roles on single server, replicate it across forest \ domain and then check from each DC if netdom query fsmo output is same

Lastly ensure that AD replication and name resolution is working correctly by below commands
repadmin /showreps
repadmin /replsum * /bysrc /bydest /sort:delta
repadmin /syncall

Finally try to raise functional level from forest root domain controller holding FSMO
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.