0

I tried to promote a Windows Server 2012 R2 instance to a domain controller at a remote site. It was looking normal until about 45 minutes into promoting it (the site was only linked by a T1). It unceremoniously failed. I could not back out or go forward.

I tried again with a new instance of the OS and about the same thing happened. Looking into the event log I saw this error:

An optional feature is enabled on this DC. However, the functional level of the forest is incompatible with the complete behavior of this optional feature.

This condition could be due to a delay in replication to this Active Directory Domain Controller of a change to the functional level of the forest, and may correct itself automatically. If this condition persists, manual intervention may be necessary.

User Action Raise the functional level of the forest to at least the minimum required functional level.

Optional feature: Recycle Bin Feature Minimum required functional level: 4 Current functional level: 4294967295

(The functional level returned is -1 using DWORD 2’c complement arithmetic)

I located the attribute in ADDS that stores the domain functional level and it is indeed set to 4.

Notes:

  • Windows Server 2008 R2 promoted and replicated fine. Windows Server 2012, reported by my team, has promoted into the domain fine from a member server. Windows Server 2012 R2 on the other hand, I was the first to promote this. 2012 R2 erroneously reports the domain functional level as 4294967295 dec, FFFFFFFF hex, -1 in 2's complement. One immediately wants to consider the bandwidth as the culprit. I am thinking not due to this return value. As I get time to confirm that this is or not, I have already considered it. If there are other suggestions, please share.
  • To distill it down to this: Why does Windows Server 2012 R2 not recognize the current functional level of the domain and forest, which are at the correct level?
|improve this question
1

I would strongly consider creating an IFM installation and transferring that to the new member server.

An IFM file can be created using ntdsutil ifm in a DC that is Server 2008 or newer. You copy that to the member server that will be promoted, and select "Install From Media" when prompted instead of selecting an existing Domain Controller to replicate from. This will get the bulk of your AD database onto the server on the other end of your slow link with only the delta needing to be replicated.

|improve this answer
  • That would certainly help replication times, but does not explain why the Windows Server 2012 R2 promotion process thinks the domain functional level is -1. I am going to experiment with this at the hub site with local access to existing DC's, I am thinking replication times are not the problem since Windows 2008 R2 works fine even at the remote sites. – Sinistar Jul 22 '14 at 20:00
  • -1 is not a valid functional level. If I had to guess, replication fails/times out which causes unexpected behavior due to contention over this slow link. After the initial sync, the amount of data needing to be replicated is tiny, which would explain why your other DCs are fine. Not saying that I know that this is definitely what's happening, but it's an easy avenue to explore. – MDMarra Jul 22 '14 at 20:27
  • A Windows Server 2008 R2 instance, starting from a member server promotes fine. It does take a long time, but they have worked consistently starting 'from scratch' is what I was trying to convey. – Sinistar Jul 22 '14 at 20:47
  • And my point is that 2008 R2 and 2012 R2 to not behave identically and can't be assumed to. – MDMarra Jul 22 '14 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.