8

We very recently completed a project to retire two old domain controllers running Server 2003 R2. They are now replaced with shiny new 2008 R2 boxes. However, the functional level of the domain has not yet been updated for the 2008 R2 servers, just in the long-shot case of the need for a rollback to the old controllers. I expect to have the all clear to update the domain by next weekend.

I also want to note that our desktop clients are still 95% Windows XP. However, we're about to start a project to update our 200 or so clients to Windows 7 before the end of the calendar year.

Is there any advantage to holding the domain at the 2003 functional level while we are still supporting more Windows XP than Windows 7, especially given that some of the management stations are still XP?

Update: I forgot to mention earlier that we still have a pair of windows 2000 servers (not domain controllers) that support some legacy software. I'm working to replace those, but in the meantime I need to be sure that Windows 2000 can still participate in a 2008 R2 domain.

Improve this question
1
  • see updated answer in regards to 2000 servers.
    – HostBits
    Jul 5, 2012 at 14:54

2 Answers 2

Reset to default
5

No, given that you will not be adding any 2003 DCs back into the domain. Raising the domain level will not affect the workstations.

(UPDATE)

Your Windows 2000 member servers should have no issues after the upgrade to 2008 R2 function level.

Improve this answer
2
  • This is probably crazy but if he had any NT workstations they would have been lost as well.
    – Brent Pabst
    Jul 5, 2012 at 14:28
  • @BrentPabst If anything they would have been lost when adding the 2008 R2 DCs into the domain, changing the domain function level wouldn't affect them.
    – HostBits
    Jul 5, 2012 at 14:37
11

Generally, updating the domain functional level provides more functionality.

The main features that 2008 domain functional level provides are:

  1. Multiple password policies per domain
  2. User-viewable last logon information
  3. Increased Kerberos encryption
  4. DFS replication for SYSVOL shares

2008 R2 domain functional level further adds:

  1. Better and more automated service account management
  2. Security logs and access lists based on authentication type

Additionally, upping to a 2008 R2 forest functional level adds an AD "recycle bin" for minor oopsies.

Improve this answer
4
  • Don't forget about the prevention of important object deletion by default as well.
    – Brent Pabst
    Jul 5, 2012 at 14:28
  • Also, be aware that some of the GPO policies that apply to XP are deprecated so there are new policies that support Vista & 7 only and even 7 only.
    – Brent Pabst
    Jul 5, 2012 at 14:30
  • @BrentPabst True, but that doesn't really have anything to do with the functional levels of the domain or forest. You can happily manage those settings from a Vista/7 client's GPMC with 2003 DCs.
    – MDMarra
    Jul 5, 2012 at 14:35
  • @MDMarra Agreed, just threw it out there, not sure how familiar the OP is with the newer policies, sounds like they are just getting into 7.
    – Brent Pabst
    Jul 5, 2012 at 14:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .