Impact in Active Directory Certificate Service - upgrade domain and forest functional level

Question

Hi,
May i know if there will be any impact on AD CS (which is installed on a different server, domain joined. Certs are being used for Exchange Server) if i will upgrade the domain and forest functional level? Currently my functional levels are Windows Server 2003, i plan to upgrade it to 2016.
Thank you

Source link:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/c1650cd1-d511-4e9a-b19a-fa155e319b6d/impact-in-active-directory-certificate-service-upgrade-domain-and-forest-functional-level?forum=winserverDS

Answer 1

Hello,
Thank you for posting here!
According to our description, we want to domain and forest functional level, and from the atticle
Forest and Domain Functional Levels, we can see:

Functional levels determine the available Active Directory Domain Services (AD DS) domain or forest capabilities. They also determine which Windows Server operating systems you can run on domain controllers in the domain or forest. However, functional levels do not affect which operating systems you can run on workstations and member servers that are joined to the domain or forest.
If we want to functional levels from Windows Server 2003 to 2016, there will be no impact on AD CS server.

And if we want to functional levels from Windows Server 2003 to 2016, before we do any change (in our case, upgrade domain / forest functional levels) to our AD environment, we should know:

1. Check that all domain controllers are working properly (run DCdiag /v on every DC) and AD replication (run repadmin /showrepl and repadmin /replsum on every DC) is OK;
2. Back up all domain controllers;
3. Ensure that all domain functional levels are equal to or higher than the forest functional level;
4. Ensure that the level of all domain controller operating systems is equal to or higher than the domain functional level;
5. The domain functional level can only be upgraded on the PDC;
6. The forest functional level can only be upgraded on the schema master.

Meanwhile, if our exchange server is installed in the AD domain controller, we had better check compatibility of the exchange version, DC or feature level.

For more information we can refer to the following links.

What is the Impact of Upgrading the Domain or Forest Functional Level?
https://learn.microsoft.com/zh-cn/archive/blogs/askds/what-is-the-impact-of-upgrading-the-domain-or-forest-functional-level

Exchange Server supportability matrix
https://learn.microsoft.com/en-us/Exchange/plan-and-deploy/supportability-matrix?view=exchserver-2019

Exchange Support For Windows Server 2016
https://learn.microsoft.com/en-us/archive/blogs/rmilne/exchange-support-for-windows-server-2016