Use ntdsutil to create IFM media on an existing healthy Domain Controller, copy it to a target server at a remote site, and promote that server with the Install from media option to skip full WAN replication.
Functional levels are the rule book that controls what an Active Directory forest and the domains in it can do. They lock the minimum Windows Server version DCs can run, gate the features available across the directory, and shape every upgrade plan. Two attributes, two scopes - forest functional level (the floor for the whole forest) and domain functional level (per-domain, must be >= forest level). The current ceiling is Windows Server 2016; 2019 and 2022 DCs run at the 2016 level. Functional levels apply only to DCs - workstations and member servers can run any Windows version. Walks the theory: schema vs forest vs domain, the forest-beats-domain rule, the features unlocked at each level (DFS-R for SYSVOL at 2008, AD Recycle Bin at 2008 R2, gMSA at 2012, Protected Users at 2012 R2, PAM at 2016), the GUI check (Active Directory Domains and Trusts) and PowerShell check (Get-ADForest / Get-ADDomain), the FRS-to-DFS-R prerequisite for raising to 2016, and the four common misconceptions (functional level does NOT control client OS, does NOT speed up DCs, etc.).
Three reliable ways to check FSMO role holders in Active Directory: the netdom query FSMO command, the Get-ADForest/Get-ADDomain PowerShell cmdlets (and the Get-ADInfo.ps1 script), and the GUI walkthrough across Active Directory Schema, Active Directory Domains and Trusts, and Active Directory Users and Computers.
Step-by-step guide to enabling the Active Directory Recycle Bin forest-wide using Active Directory Administrative Center. Covers prerequisites, the irreversible nature of the change, GUI and PowerShell verification, restoring deleted objects with Restore-ADObject, and follow-up hardening like Protect from accidental deletion.
Step-by-step guide to installing the Active Directory Domain Services (AD DS) role on Windows Server and promoting the machine to the first Domain Controller in a new forest. Covers the Add Roles and Features wizard, the Configuration Wizard, DSRM password, DNS delegation warning, paths, the auto-generated PowerShell script, and post-promotion verification.
