Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 484
  • Last Modified:

Failed to Raise Forest Function Level

Currently 3 domain controllers in single domain.  2 servers Windows 2008 R2, 1 server Windows 2008 Standard.
The domain functional level is currently Windows 2008.  In the Ad Administrative Center, there is option to raise Forest Function level.  It was Win2003.  I initiated the Raise Forest Function Level to Win2008 and it failed.

This is the message when I go back to the "Raise the Forest Function:

"To raise the forest functional level, ensure that all domain controllers in the forest are running appropriate versions of Windows Server and there are no domains in the forest with a domain functional level set to Windows 2000 mixed."

I don't have any Windows 2000 or 2003 domain controllers.  There is one lowly Win2k3 member server still operating. I know that we converted to mixed mode when we were at w2k and wk3.  However, the same screen shows the Forest Function Level at Windows 2008.  How do I verify what the Forest Function level is?
Failed.FFL.JPG
0
cobmo
Asked:
cobmo
1 Solution
 
it_saigeDeveloperCommented:
First you need to validate your Domain Functional Level:In 'Active Directory Domains and Trusts', right-click on your Domain and choose 'Properties'.The properties page will show you both the Domain and Forest Functional Level.In order to raise your Forest Functional Level, first ensure that your Domain Functional Level is *at least* Windows 2003 and that you don't have any Windows 2003 Servers in your domain (which you have stipulated that you do not).

https://technet.microsoft.com/library/understanding-active-directory-functional-levels(WS.10).aspx

You will also want to make sure that you don't have any Windows 2003 Domain Controllers left in the metadata for AD.



-saige-
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
What is the error message that you are getting? Have you checked to ensure that your AD replicaiton is working properly?

repadmin /replsum
repadmin /showrepl

Will.
0
 
Hypercat (Deb)Commented:
A few simple things to look at:

1.  Check AD Sites and Services/Sites/Default-First-Site-Name (or other site name(s)) and make sure that there aren't any old objects left in there from DCs that have been decommissioned/removed from service.

2.  You can also check using adsiedit and again make sure that there aren't any old orphaned server objects left around that might be causing the error.
0
Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

 
cobmoAuthor Commented:
In checking the Domain properties, I see it indicates the correct version (see attachment). I thought maybe I hadn't given it enough time to replicate but its been several hours on a small domain (125 users).

I checked the Domain Controllers (dcdiag /a) before I started.  I ran the replication commands and all is fine that I can tell.

AD Sites and Services only shows the 3 domain controllers.  Is there a way I can see any detailed residue?  I have had DCs in the past but have always demoted before removing from network.

Remember, I do have a Win2k3 MEMBER server still in use but understand this process affects DCs only from my research.

We started this domain with NT.  The domain name was CITY.  When we started using the FQDN the domain became CITY.STATE.US.

In the user account profiles, I still see the names that say pre-Windows 2000.  We originally used just the last name (CITY\smith).  With the introduction of email, all new users became CITY.STATE.US\tsmith.  Does the pre-Windows reference need to be deleted?  This might be a separate issue but it seems to just linger in the user configs and Im not sure that hangs domain changes up.
Domain-Properties.JPG
userprofile2.jpg
0
 
it_saigeDeveloperCommented:
Correct, member servers/computers are not considered by this process, only Domain Controllers.  The pre-Windows reference does not need to be deleted.  From the information you have posted so far, your Domain and Forest Functional Levels are correct for your current DC landscape (1 Windows Server 2008 R2 DC and 2 Windows Server 2008 DC's).

I would run a dcdiag just to be safe.

-saige-
0
 
Seth SimmonsSr. Systems AdministratorCommented:
You can't raise the functional level higher than the lowest domain controller operating system version.

Your original post states you have 3 domain controllers - 1 2008 and 2 2008 R2.

Your screenshot shows the functional level as 2008.  You can't raise it to 2008 R2 because you have a 2008 domain controller.  Once that 2008 domain controller is demoted, that leaves you with only 2008 R2 domain controllers - then you can raise the functional level to 2008 R2.

So yes, I would expect that error message if you try to raise the functional level as-is.
0
 
it_saigeDeveloperCommented:
Seth he reported that he was raising from 2003 to 2008...

-saige-
0
 
MaheshArchitectCommented:
Before attempting to raise functional levels

Check if any domain controller has public dns IP is defined under tcp/ip dns settings under preferred \ secondary, remove it, restart netlogon and dns service

Ensure no stale DC exists in metadata
ensure that references to FRS or DFS Replication Member Object are correct

Move all your FSMO roles on single server, replicate it across forest \ domain and then check from each DC if netdom query fsmo output is same

Lastly ensure that AD replication and name resolution is working correctly by below commands
repadmin /showreps
repadmin /replsum * /bysrc /bydest /sort:delta
repadmin /syncall

Finally try to raise functional level from forest root domain controller holding FSMO
0

Featured Post

Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now