This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 12%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hello,
is it supported to have a secondary domain controller on a different version of server? The primary domain controller would be 2012 R2 and the secondary 2016.
Is it anything that can go wrong in this kind of configuration?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Absolutely not a problem and a very common situation. The highest DFL in this situation is 2012 R2
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels
--please don't forget to upvote and Accept as answer if the reply is helpful--
Just checking if there's any progress or updates?
--please don't forget to upvote and Accept as answer if the reply is helpful--
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 97%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
There are situations that require domain controllers to be at a specific patch level.
For example, on Nov 9, 2021, due to the CVE-2021-42287 vulnerabilities, Microsoft released changes in authentication with KB5008380. These changes used a new methodology for patch distribution whereas the changes were released in 3 stages.
In this case, the second phase (without manually disabling) would enable the settings change. At this moment, ALL domain controllers must have this patch installed or authentications may fail.
This is just one example, but shows that having domain controllers at different patch levels will impact an environment.
Hello @Andy
You shouldn't have any issues introducing a Server 2016 into a Windows Server 2012R2 domain. This is a totally regular operation.
First of all, I would recommend to run a DCDIAG command to check the health of your current DC before promoting, after that just follow the usual promotion proces. I would also recommend to add the DNS role into the new server and make it Global Catalog, for redundancy.
You can find some guidelines and screenshots of the promotion process here: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers .This may also help you in case you wat to rise the Functional Level of your domain to 2016, keeping the 2012R2 as secondary and 2016 as primary.
Hope this helps in your case,
Best regards,
