Do all domain controllers in an Active Directory environment have to use the same Windows Server version, or can different versions run together? How do domain and forest functional levels affect which versions are supported and when those levels can be raised?
4 Answers
The functional level applies to Active Directory behavior, not to every server or workstation in the domain. Member computers can run other versions, but very old domain controllers may prevent newer security features and can block upgrades to the functional level you want.
No, domain controllers can run different Windows Server versions at the same time. The domain and forest functional levels determine the minimum supported DC version and which Active Directory features are available. Mixed versions are common during migrations.
Although identical versions are not required, standardizing your DCs is usually easier for patching, troubleshooting, and lifecycle management. Keep every DC on a supported operating system and make sure the functional level is compatible with the oldest one still acting as a domain controller.
You generally cannot raise the functional level while an older domain controller is still active. Replace or demote the older DCs first, confirm replication and DNS are healthy, then raise the domain or forest functional level if needed. Windows Server 2019 and 2022 typically use the 2016 functional level, while newer functional levels depend on the Windows Server release.
Also remember that the forest functional level is separate from the domain functional level. In a forest with multiple domains, it must meet the compatibility requirements for the forest as a whole.