ADDOM-002: Domain Functional Level
- Platform
- Active Directory
- Category
- AD Domain & Forest Configuration
- Severity
- High
- Zero Trust pillar
- Governance (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guerrilla binds to the domain naming context and reads the msDS-Behavior-Version attribute on the domainDNS object (the object at the root of the domain partition, for example DC=contoso,DC=com). That attribute is an integer constant defined in [MS-ADTS] section 6.1.4.4: value 0 is Windows 2000 mixed/native, 2 is Windows Server 2003, 3 is Windows Server 2008, 4 is Windows Server 2008 R2, 5 is Windows Server 2012, 6 is Windows Server 2012 R2, and 7 is Windows Server 2016. There is no DFL constant for Windows Server 2019, 2022, or 2025; the schema and the domain stop advancing at level 7. The check raises a finding when the value is less than 7. As a sanity cross-check it also enumerates every domain controller via (objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192) and reads operatingSystemVersion to confirm that no DC is running an OS older than Windows Server 2016 (build 10.0.14393), which would block raising the level.
Why it matters
The DFL is the gate Microsoft uses to introduce new directory-side security primitives without breaking older domain controllers. The features that ship behind DFL 7 (Windows Server 2016) are the ones most relevant to credential theft defense: - Protected Users group: KDC-side enforcement that members cannot use NTLM, cannot use DES or RC4 Kerberos cipher suites, cannot use unconstrained delegation, cannot be delegated via constrained delegation, and that TGT lifetime is capped at four hours. Without DFL 7, the group exists but the KDC enforcement is partial; lower DFLs leak the most important controls. - Authentication policies and authentication policy silos: directory-stored policy objects that bind a user, computer, or service account to a set of allowed sign-in workstations, lifetime, and required claim types. Silos are the supported mechanism for Tier 0 isolation and are unavailable below DFL 7. - Kerberos armoring (FAST) compound identity: enforced FAST on KDC requests requires DFL 7 to advertise the capability across the domain. - Privileged Access Management feature set, including shadow security principals from a bastion forest. A domain stuck at Windows Server 2008 R2 or 2012 R2 leaves an environment unable to deploy any of the above. Operationally that means there is no enforceable way to prevent a Domain Admin account from being used over NTLM, no way to bind krbtgt and tier-0 service accounts to specific privileged access workstations, and no way to enforce armored AS-REQ. The blast radius is the entire domain: every credential theft mitigation Microsoft has shipped in the last decade is silently disabled.
Attack path
A low DFL is not itself an exploit. It is a precondition that unlocks attacks elsewhere in the kill chain. Typical sequence: Step 1: Initial access. The attacker establishes a foothold on any domain-joined workstation via phishing, exposed RDP, or a vulnerable internet-facing service. Step 2: Credential harvesting. The attacker runs Rubeus or Mimikatz against LSASS and harvests TGTs and NTLM hashes for any account that has logged on. Because Protected Users enforcement is not gated by DFL 7, accounts the organization believes are protected (added to the Protected Users group) still cache RC4 long-term keys and NTLM hashes on workstations. Step 3: Lateral movement via overpass-the-hash. The attacker uses Rubeus asktgt /user:admin /rc4:<hash> to mint a TGT from a stolen RC4 hash. With DFL 7 and Protected Users enforcement the KDC would refuse to issue a TGT that uses RC4 for a member of Protected Users; with DFL below 7 the KDC happily issues the ticket. Step 4: Tier-0 pivot. The attacker identifies a domain admin account and looks for authentication policy silo membership. Because the DFL is too low to support silos, no silo exists, so there is no directory-side restriction on which workstation the admin can be used from. The attacker uses the stolen credential against any DC. Step 5: Persistence. The attacker performs DCSync, extracts the krbtgt hash, and forges Golden Tickets. With DFL 7 and authentication policies, an organization could at least bind krbtgt-derived authentications to known endpoints; below DFL 7 that control is unavailable. The attack uses no zero-day. The DFL is the missing control that makes commodity tools (Rubeus, Mimikatz, Impacket secretsdump, Impacket getTGT) effective end to end.
How Guerrilla assesses it
Guerrilla performs a single LDAP read on the domain naming context root: Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties msDS-Behavior-Version. The returned integer is compared against the constant 7 (DOMAIN_BEHAVIOR_WIN2016). Any value less than 7 produces a fail. The check also surfaces the human-readable name via the .NET enumeration System.DirectoryServices.ActiveDirectory.DomainMode for operator output. As a secondary signal, Guerrilla queries (&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192)) to list every domain controller, reads operatingSystemVersion, and reports the minimum DC OS build. If any DC reports an OS older than Windows Server 2016 (build 10.0.14393), the remediation is blocked until that DC is decommissioned or upgraded, and Guerrilla calls that out explicitly so the operator does not attempt a raise that will fail. The check is read-only and runs entirely over LDAP and Active Directory Web Services on TCP 9389.
Recommended value
Windows Server 2016 or higher
Remediation
Raise the domain functional level via Active Directory Domains and Trusts > Right-click the domain > Raise Domain Functional Level. Verify all DCs in the domain are running a compatible OS version first
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-6, SI-2
- CIS Benchmark
- 18.3.1
- ANSSI
- R1
- CIS AD Benchmark
- 1.1.2
- MITRE ATT&CK
- T1078.002