Error 8565: raise the forest functional level before adding this controller

Fix it now

Error 8565 is ERROR_DS_FOREST_VERSION_TOO_LOW: the operating system on the server you are promoting no longer supports the forest functional level you have, so it will not join. Nothing is wrong with the server, the media or your credentials. The forest level has to come up first, and it cannot while any domain controller in scope is below it.

Get-ADForest | Format-List Name,ForestMode
Get-ADDomain | Format-List Name,DomainMode
Get-ADDomainController -Filter * | Format-Table Name,OperatingSystem,OperatingSystemVersion,Site -AutoSize
repadmin /replsummary

1. Read the two levels and the controller list together. Any server running an operating system older than the level you need is the blocker, whether or not it is switched on.
2. Fix replication before anything else. Raising a level on top of a replication fault leaves controllers disagreeing about the level itself, which is a worse problem than the one you started with.
3. Deal with each blocking controller: upgrade it, or remove it with Uninstall-ADDSDomainController run on that machine. A server that no longer exists still counts until its metadata is cleaned up.
4. Raise the domain first and then the forest, as a member of Enterprise Admins, from Active Directory Domains and Trusts or with Set-ADDomainMode and Set-ADForestMode. The forest level can never exceed the lowest domain level.

Microsoft states that changes to domain and forest functional levels are irreversible, and that undoing one means a forest recovery to an earlier point in time. Take a system state backup of two healthy controllers before you raise anything.

If the promotion prerequisite now passes, you are done. If it does not, the next section explains which half of the check is failing and what else pins a level down.

Why it happens

A functional level is a contract. It states the behaviours every domain controller holding a copy of the partition is guaranteed to support, which is why Active Directory refuses to run at a level any member controller cannot honour. The constraint you have hit is the same rule read from the other end: each server release declares the oldest forest and domain it is willing to join, and refuses to become a domain controller in anything older.

Microsoft’s wording for 8565 is that the version of the operating system installed on this server no longer supports the current forest functional level, and that you must raise the forest functional level before this server can become a domain controller. 8566 says the same thing about the domain. Neither is a bug, a permissions problem or a media problem, which is why running the wizard again produces the same answer every time.

Two more codes sit in the same group and mean the opposite. 8563 is ERROR_DS_FOREST_VERSION_TOO_HIGH and 8564 is ERROR_DS_DOMAIN_VERSION_TOO_HIGH: the level is higher than the server you are installing supports, and you must upgrade the operating system instead. That direction has no configuration fix at all, because functional levels do not come down.

The floor is not new, and it is worth being precise about because a lot of advice implies each release raises it. Microsoft states that Windows Server 2019 or later requires a Windows Server 2008 forest functional level as a minimum, and groups current releases with that. If you are hitting 8565, your forest is at a level older than that – which usually means it has been running, untouched, since well before anyone currently on the team arrived.

Full reference

Which half of the check is refusing you

So the two pairs point in opposite directions, and mixing them up wastes a change window. Too low means the directory is older than the server; too high means the server is older than the directory. Only the first has a configuration answer.

What the raise actually requires

• Every domain controller in the domain must already be running at least the version of Windows Server you are raising the domain level to.
• You must be a member of Enterprise Admins, or equivalent, to raise the forest level.
• The forest level cannot exceed the lowest domain level in the forest.
• Replication must be converged first, so that every controller sees the same set of controllers before the level is written.
• The change is irreversible. Microsoft’s guidance is explicit: to undo it you must perform a forest recovery to revert to an earlier point in time.

Take a system state backup of two healthy domain controllers before raising a level, and confirm the backups are readable. There is no supported way back afterwards short of a forest recovery, which is a project rather than an afternoon.

Commands worth knowing here

Doing it through the console instead

1. Open Active Directory Domains and Trusts.
2. In the console tree, right-click the domain node and select Raise Domain Functional Level. Repeat for every domain that is behind.
3. Right-click Active Directory Domains and Trusts itself and select Raise Forest Functional Level.
4. Let the change replicate, then read the level back from a controller in a different site before you touch the promotion again.

When the level is right and promotion still fails

• Check that the removal of the old controller has actually replicated everywhere, not just to the server you are standing at.
• Check DNS for records still advertising the removed controller, particularly under the _msdcs zone, which will keep clients and tools trying to reach it.
• Confirm no read-only controller in a forgotten site is still below the level. They are easy to miss because nobody administers them directly.
• Confirm you are promoting into the domain you think you are, in a forest with more than one domain.
• Run the promotion prerequisite check on the new server before committing, so a second failure costs you a minute rather than a maintenance window.

Every code this article covers

Confirm the fix worked

1. Get-ADForest and Get-ADDomain read back the new levels from two controllers in different sites.
2. Get-ADDomainController -Filter * no longer lists any server you removed.
3. The promotion prerequisite check on the new server passes without the level error.
4. After promotion, replication summarises clean across the estate and the new controller appears in the site you intended.
5. A system state backup taken after the raise restores successfully in a test, since there is no way back from the level change itself.

Questions people ask about this