How to check AD DS domain/forest functional level from domain joined workstation?

The following Powershell does not require admin or domain admin access, I've tested as a limited user on a domain-joined workstation with Powershell v2/v3. It does not require any third party tools or Powershell modules.

$dse = ([ADSI] "LDAP://RootDSE")

# Domain Controller Functional Level
$dse.domainControllerFunctionality

# Domain Functional Level
$dse.domainFunctionality

# Forest Functional Level
$dse.forestFunctionality

The values returned will represent a distinct functional level:

Value  Forest        Domain             Domain Controller
0      2000          2000 Mixed/Native  2000
1      2003 Interim  2003 Interim       N/A
2      2003          2003               2003
3      2008          2008               2008
4      2008 R2       2008 R2            2008 R2
5      2012          2012               2012
6      2012 R2       2012 R2            2012 R2
7      2016          2016               2016

References:

• [MS-ADTS] msDS-Behavior-Version: Forest Functional Level
• [MS-ADTS] msDS-Behavior-Version: Domain NC Functional Level
• [MS-ADTS] msDS-Behavior-Version: DC Functional Level

Just a complementary solution to the accepted answer, as I ended up here more or less with the same need. The difference is one gets the level name decoded:

Import-Module ActiveDirectory
$ForestRoot = 'top.domain'

(get-adforest -identity $ForestRoot).ForestMode

(get-adforest -identity $ForestRoot).Domains |
ForEach-Object {Get-ADDomain -Identity $_ |
ft DNSRoot,DomainMode -AutoSize}

You just want to check it or actually change it? Changing it would require certain administrative rights on the domain/forest.

The easiest way I can think of without dsquery or PS Get-ADDomain (which would require importing the AD module) is to use Joeware's ADFIND command.

http://www.joeware.net/freetools/tools/adfind/

adfind -rootdse domaincontrollerfunctionality domainfunctionality forestfunctionality

Example output from my domain:

AdFind V01.47.00cpp Joe Richards ([email protected]) October 2012

Using server: DOMAIN-DC1.hahaha.local:389

Directory: Windows Server 2008 R2

dn:

domainFunctionality: 4 [Windows Server 2008 R2 Domain Mode]

forestFunctionality: 4 [Windows Server 2008 R2 Forest Mode]

domainControllerFunctionality: 4 [Windows Server 2008 R2 Mode]

1 Objects returned