Error Raising Domain Functional Level from Windows 2012 R2 to 2016

Question

Error Raising Domain Functional Level from Windows 2012 R2 to 2016

TaylorRobertA-8225 0

Attempting to raise the domain functional level from Windows 2012 R2 to Windows 2016 results in the following error: "The functional Level could not be raised. The error is: The server is unwilling to process the request." This occurs when using ADUC and AD Domain and Trust.

It is suspected that the error relates to a lingering object in the LostAndFoundConfig container via ADSI Edit, which appears to be associated with a previously demoted RDOC. Despite having an Enterprise Admin account, deletion of this object is not possible.

What methods can be employed to delete this object, and could it be the root cause of the issue preventing the increase in domain functional level?

TaylorRobertA-8225 0 Reputation points

2025-03-24T02:29:22.7433333+00:00

The object name is CN=RODC Connection (SYSVOL) and class is nTDSConnection

1 answer

Your answer

TaylorRobertA-8225 0 Reputation points

2025-03-24T02:29:22.7433333+00:00

The object name is CN=RODC Connection (SYSVOL) and class is nTDSConnection

Answer 1

Molly Lu-MSFT 2,591 Microsoft External Staff

Hello,

Thank you for posting in Microsoft Q&A.

Based on the description, I understand your question is related to Error Raising Domain Functional Level from Windows 2012 R2 to 2016.

Press Win + R, type adsiedit.msc, and press Enter. Expand Configuration > CN=Configuration,DC=domain,DC=com > CN=LostAndFoundConfig. Right-click the lingering object and select Delete.

Run below Powershell commands as admin to remove lingering objects:

ntdsutil

metadata cleanup

remove selected server <ServerName>

quit

Open ADUC. Right-click the domain and select Raise Domain Functional Level. Select Windows Server 2016 and click Raise.

reference:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/dsa-object-cannot-be-deleted

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/information-lingering-objects

Have a nice day.

Best Regards,

Molly

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it

TaylorRobertA-8225 0 Reputation points

2025-03-24T13:46:10.1166667+00:00

Thank you for your response. I am encountering an access denied error when trying to delete the object (CN=RODC Connection (SYSVOL)) from the ADSI's LostAndFoundConfig container. Despite using an enterprise admin account, the object's security permissions do not allow this account to delete it. I tried granting full permissions on the object; however, it still indicates that the account lacks 'delete' permissions.

Should I clean up the metadata and enter the demoted DC associated with the object?
TaylorRobertA-8225 0 Reputation points

2025-04-11T13:18:22.0933333+00:00

I reset permissions and was able to delete the folder and object from LostAndFoundConfig containter.

Share via

Error Raising Domain Functional Level from Windows 2012 R2 to 2016

1 answer

Your answer