Event IDs and Logs for Active Directory domain upgrade

Question

Hi,

Someone has upgraded our Active Directory domain functional levels to 2008 (from 2008). We don't know who or when it was done. What's the best way to determine when and who made the change?

Is an event logged on the DCs?

Thanks

Answer 1

Hi @Dan Bhatoa ,

In the following MS Learn article the Event ID 16408 is being mentioned:

How to raise Active Directory domain and forest functional levels
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/raise-active-directory-domain-forest-functional-levels?WT.mc_id=EM-MVP-5002219

Event Type: Information    
Event Source: SAM    
Event ID: 16408    
Computer:Server Name    
Description: "Domain operation mode has been changed to Native Mode. The change cannot be reversed."  

but imho you cannot obtain more details about who did this. The only way to achieve this would be to have already Auditing enabled. If you had Auditing enabled then you can look for Event ID 4739 in the Security Log on your domain controllers and there you can obtain more info regarding "Who" raised the FL.

4739(S): Domain Policy was changed.
https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4739?WT.mc_id=EM-MVP-5002219

---

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)
Regards
Stoyan Chalakov

Answer 2

Thanks for confirming Stoyan