Active Directory Domain Modes in Windows 2000

Before Microsoft introduced formal Domain Functional Levels in Windows Server 2003, Windows 2000 Active Directory managed operating system compatibility and feature availability through a mechanism called Domain Modes. This article explores the precursor to modern functional levels, focusing on how Windows 2000 Native Mode served as the maximum configuration state for Windows 2000 domains.

The Precursor: Mixed Mode vs. Native Mode

In Windows 2000 Server, domain capabilities were defined by two distinct operational states: Mixed Mode and Native Mode. This system acted as the architectural foundation for what later evolved into Domain Functional Levels (DFLs) and Forest Functional Levels (FFLs).

  • Mixed Mode (Default): This was the initial state of any newly created Windows 2000 domain. Mixed Mode ensured backward compatibility by allowing legacy Windows NT 4.0 Backup Domain Controllers (BDCs) to coexist and replicate with Windows 2000 primary domain controllers. However, this compatibility imposed severe limits on Active Directory features to accommodate NT 4.0 replication constraints.
  • Native Mode (Maximum Setting): Windows 2000 Native Mode was the highest operational tier available in Windows 2000 Active Directory. Operating in Native Mode required every domain controller in the domain to run Windows 2000 Server, completely dropping support for Windows NT 4.0 BDCs.

Capabilities Unlocked in Windows 2000 Native Mode

Switching a domain to Native Mode permanently removed NT 4.0 replication protocols and unlocked full Active Directory group management features, including:

  • Universal Security Groups: Creation and use of Universal security groups across the forest.
  • Group Nesting: The ability to nest global groups within other global groups, domain local groups within other domain local groups, and universal groups inside local groups.
  • Group Type and Scope Conversion: Dynamic conversion between security groups and distribution groups, as well as converting group scopes (such as global to universal, provided no illegal nesting existed).
  • SID History: Preservation of user and group Security Identifiers (SIDs) during inter-domain migrations using tools like the Active Directory Migration Tool (ADMT).

Transition and Evolution

Raising a domain from Mixed Mode to Native Mode was performed using the Active Directory Domains and Trusts or Active Directory Users and Computers snap-ins. The transition was a one-way, irreversible operation. Once upgraded to Native Mode, an administrator could not introduce a Windows NT 4.0 domain controller into the environment.

With the release of Windows Server 2003, Microsoft expanded this concept into granular Domain Functional Levels (introducing options like Windows 2000 Native, Windows Server 2003 Interim, and Windows Server 2003 levels) and added Forest Functional Levels, creating the scalable lifecycle management model used in enterprise environments today.