Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Active Directory functional levels control which Active Directory features are available in a domain and across the entire forest. If you’re planning an upgrade, deploying newer domain controllers, or troubleshooting replication/feature behavior, you need an accurate answer for both domain and forest functional levels.
This guide shows several reliable ways to check functional levels—GUI and PowerShell—so you can verify the current state without guessing. You’ll also learn how to interpret the values and what to do when commands return nothing or errors.
As an Amazon Associate I earn from qualifying purchases.
What Functional Level Means (Domain vs. Forest)
Domain functional level is the minimum feature set enabled for a specific domain. Raising it allows domain-scoped features that may require newer Windows Server versions.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Forest functional level is the minimum feature set across the whole forest. It gates features that are forest-wide (not just inside one domain) and can be more restrictive.
#1 Best Overall
In practice, you often see the domain level at or below the forest level. You can raise one without the other, but you must follow Microsoft’s upgrade rules and compatibility requirements.
Prerequisites and Permissions
Before you check functional levels, confirm you have the right access and tools installed. A functional level query is read-only, but you still need directory read permissions and, for some GUI consoles, administrative privileges to open the right properties pages.
Minimum permissions
- At least Domain Users can often read functional level via PowerShell if the account can query AD, but in real environments you’ll usually use an account with permissions to read directory configuration.
- To avoid surprises, use an account with Domain Admins or equivalent rights when running GUI consoles.
Required modules and OS support
- For the most reliable results, use Windows PowerShell 5.1 or newer with the ActiveDirectory module.
- On Windows Server, you can install the RSAT feature that includes Active Directory tools (often called Active Directory Domain Services Tools).
If you’re on Windows Server Core or a workstation without the module, use the PowerShell method after installing RSAT, or use an alternative GUI path where available.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteMethod 1: Check Functional Level from AD Administrative Center (GUI)
The Active Directory Administrative Center (ADAC) gives a clean GUI view, especially on newer Windows Server builds. It’s often the easiest GUI option once ADAC is installed.
Steps
- Open Active Directory Administrative Center (from Server Manager or by searching on the Start menu).
- In the left tree, click your Active Directory instance.
- Expand the navigation to find AD Sites and then Domains (exact placement can vary slightly by ADAC version).
- Locate your domain, then select it and look for Properties.
- In the Properties window, find Functional level for the domain.
- To find the forest functional level, locate forest-level properties from the root/connection node for your forest. If you don’t see it directly in Properties, switch to Method 2 or PowerShell.
If ADAC doesn’t show forest functional level clearly (this can happen depending on console version and permissions), use the PowerShell method below. It’s the most consistent across environments.
Method 2: Check Functional Level from Active Directory Domains and Trusts (GUI)
This is the classic MMC route. It’s dependable and commonly available on Windows Server systems with AD DS tools installed.
Steps (domain and forest)
- Open Active Directory Domains and Trusts (run
domain.msc). - In the left pane, click your domain name.
- Right-click and choose Properties.
- Look for Functional level—this is the domain functional level.
- To find forest functional level, you typically check it from the Active Directory Domains and Trusts console root via forest-level properties, which may require additional navigation or a connection to the forest root.
Because GUI placement can differ, many admins prefer PowerShell for the forest functional level. If you can’t find the forest value in your MMC, Method 3 will give it precisely.
Method 3: Check Functional Level with PowerShell (Recommended)
PowerShell is the fastest and most exact way to retrieve both domain and forest functional levels. It avoids console UI differences and returns values in a form you can log and compare over time.
Rank #2
- Used Book in Good Condition
Install the ActiveDirectory module (if needed)
On Windows Server, you can install RSAT tools. On a workstation, ensure the RSAT AD module is present.
- Then verify the module loads:
Import-Module ActiveDirectory
Check forest functional level
- Open an elevated PowerShell window (Run as Administrator).
- Run:
Import-Module ActiveDirectory
Get-ADForest | Select-Object Name, ForestMode, DomainNamingMaster
The ForestMode value is the forest functional level (for example, Windows2012R2Forest or Windows2016Forest).
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCheck domain functional level
- Run:
Get-ADDomain | Select-Object DNSRoot, NetBIOSName, DomainMode, PDCEmulatorThe DomainMode value is the domain functional level (for example, Windows2012R2Domain or Windows2016Domain).
Check all domains in the forest (common in multi-domain forests)
- Run:
$forest = Get-ADForest
$domains = $forest.Domains
$results = foreach ($d in $domains) { Get-ADDomain -Identity $d | Select-Object DNSRoot, DomainMode
}
$results | Sort-Object DNSRoot | Format-Table -AutoSize
This is especially helpful if you have multiple domains and want to confirm whether one domain lags behind the rest.
Export results for auditing
$forest = Get-ADForest
$forest | Select-Object Name, ForestMode | Out-File -Encoding UTF8 .\ad-forest-functional-level.txt
$domains = $forest.Domains | ForEach-Object { Get-ADDomain -Identity $_ | Select-Object DNSRoot, DomainMode }
$domains | Export-Csv .\ad-domain-functional-levels.csv -NoTypeInformation -Encoding UTF8
Auditing matters when you’re planning upgrades, because functional levels should be tracked like configuration baselines.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Method 4: Check Functional Level with AD Module Tools and Command Line
If PowerShell isn’t available (locked-down environments), you can still extract some information using other AD tools, though the exact forest/domain functional level output can vary. In most real environments, PowerShell remains the most consistent.
Common command-line approach
Depending on your tooling, you may use dsquery / dsget approaches to locate configuration objects and then infer modes. That said, results are harder to interpret than the direct Get-ADForest and Get-ADDomain properties.
If you need certainty quickly, use PowerShell rather than reconstructing functional levels from directory objects.
Interpreting Results and Mapping Levels to Windows Versions
PowerShell returns functional levels as strings like Windows2012R2Forest. The naming usually maps cleanly to the minimum Windows Server version whose domain controller features are enabled.
Typical mapping you’ll see
| Returned value example | Meaning |
|---|---|
Windows2008Domain / Windows2008Forest |
Functional level aligned with Windows Server 2008-era features |
Windows2008R2Domain / Windows2008R2Forest |
Functional level aligned with Windows Server 2008 R2 features |
Windows2012Domain / Windows2012Forest |
Functional level aligned with Windows Server 2012 features |
Windows2012R2Domain / Windows2012R2Forest |
Functional level aligned with Windows Server 2012 R2 features |
Windows2016Domain / Windows2016Forest |
Functional level aligned with Windows Server 2016 features |
Windows2019Domain / Windows2019Forest |
Functional level aligned with Windows Server 2019 features |
Windows2022Domain / Windows2022Forest |
Functional level aligned with Windows Server 2022 features |
If you need exact feature gating details for a specific Windows Server release, base it on the official Microsoft functional level feature matrix for that version.
Rank #4
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Common Issues and Troubleshooting
Functional level checks are simple when AD is healthy. When you hit errors, it’s usually connectivity, DNS, module installation, or targeting the wrong domain controller.
PowerShell error: ActiveDirectory module not found
Symptom: Import-Module : The specified module 'ActiveDirectory' was not loaded.
- Install RSAT AD DS tools on the machine running PowerShell.
- Confirm PowerShell version is modern enough (5.1 is typically fine).
- Re-run
Import-Module ActiveDirectory.
PowerShell error: Cannot find object or DNS issues
Symptom: Get-ADForest fails, often with messages about connectivity or naming.
- Verify DNS resolves your domain controllers: run
nslookup <your-domain>. - Check that your client can reach a domain controller over 53/88/389 (or whatever ports your environment uses).
- Try specifying a domain controller explicitly:
$dc = "dc01.yourdomain.local"
Get-ADForest -Server $dc | Select Name, ForestMode
Get-ADDomain -Server $dc | Select DNSRoot, DomainMode
Inconsistent values across domains
Symptom: forest functional level is higher than a particular domain functional level.
- That’s possible and not necessarily incorrect—one domain can lag if functional level was raised earlier for some domains or a specific administrative decision was deferred.
- Use the “all domains” script from Method 3 to pinpoint which domain differs.
GUI doesn’t show forest functional level
Some console views don’t expose forest functional level cleanly. If the MMC doesn’t show what you need, switch to PowerShell immediately. It’s the most reliable method for audit-grade output.
Replication or authentication problems
Functional level values are directory attributes, so if you’re seeing strange failures, the underlying AD health issue may be your real problem. Check replication and authentication first (replication status, DC event logs, and DNS records), then re-run the PowerShell queries.
Recommended Free Tools
When You Should Care (Upgrade Planning and Compatibility)
Knowing domain and forest functional levels helps you plan upgrades with fewer surprises. You’ll also avoid installing features or expecting behaviors that your current modes don’t support.
Best Value
Concrete scenarios
- Raising functional level: You can’t raise the forest functional level unless requirements are met across the forest, including DC version readiness and absence of incompatible domain controllers.
- New DC deployments: You need a minimum functional level and compatible schema expectations for certain operations.
- Compatibility troubleshooting: If an application depends on directory behaviors introduced in a specific Windows Server generation, mismatched functional levels can look like “random” auth failures.
If you’re doing an upgrade project (for example, moving from Windows Server 2012 R2-era modes toward newer builds), treat these functional level checks as a baseline artifact you can attach to your change record.
FAQs
Can I check functional level without being a Domain Admin?
You might be able to read it depending on your AD read permissions and how your environment secures directory queries. In practice, Domain Admin (or equivalent) avoids authorization issues, especially with GUI consoles.
Will functional level change automatically when I add newer domain controllers?
No. Adding or upgrading domain controllers doesn’t automatically raise functional levels. Functional level updates are an explicit action.
Free tools Windows power users keep installed
One-click scans. No signup required.
What’s the difference between functional level and schema version?
Schema version tracks the schema’s current revision. Functional level controls which domain/forest features are enabled. You can have a newer schema with a lower functional level in certain scenarios.
Why does PowerShell show strings like Windows2016Forest instead of a number?
Microsoft represents functional levels as named enums. Those strings correspond to specific functional level gates that map to particular Windows Server feature sets.
Bottom Line
For precise, audit-friendly results, use PowerShell: Get-ADForest for ForestMode and Get-ADDomain for DomainMode. GUI tools can work for domain values, but PowerShell is consistently better for forest-level verification and multi-domain forests.
Once you know both levels, you can plan upgrades and feature deployments with confidence—and you’ll be able to explain compatibility constraints to stakeholders without guesswork.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
