• Up to 15 times faster large LDAP searches: listing all computers, the global address list and group members nowtake seconds instead of minutes
• Looking up a computer by its DNS name is now faster than on a Windows domain controller
• Account searches such as “all disabled users” are now faster than on a Windows domain controller
• Paged searches produce each page on demand, so the first results appear immediately and every object is processed only once
• Permission checks for search results are evaluated once per search instead of once per object
• Prefix searches such as “all accounts starting with sbx00” are answered from the index, on par with a Windows domain controller
• Additional attributes can be indexed on a single domain controller without changing the shared schema
• Adding a new index takes seconds and no longer requires rebuilding the whole database index
• Faster writes on large directories: adding and removing computers no longer rewrites very large index lists

Database and replication

• Sharded directory database: each partition now locks only itself, so logons, DNS and replication no longer wait for each other
• Optional unified database engine with a single, faster write path for all partitions
• Much faster replication: large domains now converge in minutes instead of days
• Parallel replication with a fixed, predictable number of slots — one slow partner can no longer hold up the others
• Dedicated fast lane for urgent work: password changes and RODC single-object requests are never queued behind bulk traffic
• Writable domain controllers get priority over read-only ones for replication and change notifications
• Smarter back-off for busy partners, with immediate retry as soon as a partner reports new changes
• Background processing of security descriptor updates keeps the replication service responsive at all times
• Read-only domain controllers keep replicating even when their partner list still references domain controllers removed from the domain

Windows compatibility

• Fully Windows-compatible conflict handling, deleted-object handling and duplicate-value handling
• Fixed a Windows interoperability loop caused by upper/lower case differences in service principal names
• Unchanged SPN and attribute rewrites from Windows clients no longer trigger needless replication
• DNS records are now registered in Windows-compatible form, ending duplicate and reappearing DNS entries
• BIND DNS integration now repairs itself after database maintenance

Domain controllers and services

• Read-only domain controllers: hardened model, safer password caching and faster single-object replication
• Kerberos (KDC): more reliable under heavy load; clients now fail over to another domain controller instead of seeing”user not found” errors
• Background queue for logon time updates, so logons are never slowed down by database writes
• Active Directory Web Services (ADWS) for RSAT and PowerShell management tools
• Key Trust (Windows Hello for Business) sign-in support
• DFSR support for SYSVOL replication and site replication schedules

Management and security

• New database maintenance tools: compaction, resizing, analysis, targeted index rebuild with accurate progress reporting, and automatic health checks
• New and improved samba-tool commands for replication diagnostics, conflict cleanup and RODC management
• Improved monitoring: replication status, stuck-queue warnings and DNS health checks
• Security updates from upstream Samba (12 CVE fixes)
• Overall performance, stability and memory usage improvements