AD-DOM-01: Domain functional level should be retrievable


ID	`AD-DOM-01`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain and forest
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

The domain functional level determines which Active Directory features are available in your domain. Higher functional levels unlock important security capabilities:

Windows Server 2016+: Enables features like privileged access management (PAM), temporary group membership, and enhanced authentication policies
Windows Server 2012 R2+: Provides access to claims-based authentication and compound authentication
Security Posture: Running at lower functional levels means missing modern security features that protect against contemporary attack vectors

Control Type

Preventive

Security Recommendation

Aim to maintain your domain at the highest functional level supported by your domain controllers. Before raising the functional level:

Verify all domain controllers are running a Windows Server version that supports the target level
Test applications for compatibility with the higher functional level
Plan the upgrade during a maintenance window
Document the change and communicate to stakeholders

How the Test Works

This test retrieves the current domain functional level from Active Directory and displays it along with basic domain information. The test is informational and helps you understand your current security capabilities.

Test-MtAdForestFunctionalLevel - Retrieves the forest functional level
Test-MtAdDomainControllerCount - Counts domain controllers in the domain

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).