Forum Discussion

Brass Contributor

May 09, 2022

Any potential problems with mixed OS versions for Active Directory PDC?

Hi All, Just wanted to get people's opinions on the following: I have a customer with multiple sites, and 3 domain controllers. They also have a Microsoft volume license account so licensing...

Active Directory

windows server

LainRobertson

Silver Contributor

May 10, 2022

Given two of the three domain controllers are Server 2016, the only change that will occur will be when the PDC FSMO role is transferred from the 2008 R2 domain controller to one of those existing Server 2016 boxes, at which point the new PDC FSMO role holder will create two new privileged groups (Key Admins and Enterprise Key Admins). That's all.

The other new functionalities - such as PAM (Server 2016 but with forest functional level 2012 R2) or Protected Users (domain functional level 2012 R2) - have to be explicitly lit up by deliberately increasing the functional levels. Until that happens, no behavioural changes occur.

Exchange Server manages its own settings, including schema extensions and permissions on the default and configuration naming contexts.

There's no danger to Exchange Server in this scenario. There's anecdotally (as much as you can gauge such things from forums such as these) more danger to Exchange from Exchange itself when running cumulative updates.

Cheers,
Lain

Alban1999

Iron Contributor

May 12, 2022

Hello Lain, I'm not thinking about AD features or domain/forest functional levels, but Exchange supported scenarios for Active Directory environments - you just cannot mix any Exchange versions with any OS versions for domain controllers. If you do not follow precisely those requirements, Exchange breaks.

LainRobertson
Silver Contributor
May 12, 2022
Alban1999

Yes, you're 100% correct about that, but that doesn't explicitly preclude mixing Active Directory operating system versions carte blanche.

While we don't know Ted_Mittelstaedt's client's Exchange 2016 cumulative update level, if it's within the supported range of [n] to [n-1] (i.e. CU23 or 22) ) then they're supported to work against Windows Server 2019 domain controllers, which is as far as the client can go for now from what Ted said anyway.

That being the case, there's no formal (with the caveat on us not knowing the Exchange CU level) reason to limit the replacement of the 2008 R2 DC to Server 2016. The only outcome would be cutting down platform supportability by years.

So long as everything lines up within the supportability matrix (included below for Ted's benefit), mixed domain controllers is fully supported.

Exchange Server supportability matrix | Microsoft Docs

Cheers,
Lain