AD-FOR-01: Forest functional level should be retrievable


ID	`AD-FOR-01`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain and forest
Security area	Infrastructure hardening
Resource type	Tenant
Reads from	On-premises Active Directory

What this checks and how to fix it

The forest functional level determines which Active Directory features are available across all domains in the forest. Higher functional levels unlock important forest-wide security capabilities:

Windows Server 2016+: Enables features like privileged access management (PAM) across the forest
Windows Server 2012 R2+: Provides access to forest-wide authentication policies and silos
Global Features: Some features require forest-wide consistency to function
Security Posture: Running at lower levels means missing modern security features

Control Type

Preventive

Security Recommendation

Aim to maintain your forest at the highest functional level supported by all domain controllers:

Verify Compatibility: Ensure all DCs in all domains support the target level
Test Applications: Verify critical applications work at the higher level
Plan Maintenance Window: Schedule the upgrade appropriately
Document Changes: Record the upgrade for audit and compliance purposes

How the Test Works

This test retrieves the current forest functional level from Active Directory along with basic forest information including the root domain and domain count.

Test-MtAdDomainFunctionalLevel - Retrieves the domain functional level
Test-MtAdForestDomainCount - Counts domains in the forest

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).