In OES 2018 SP1 or later because of the incompatibilities introduced from the updated versions of Kerberos and Samba, the domain controller having OES 2018 SP2 cannot coexist with domain controllers having the earlier OES versions. The mixed mode configuration is not supported.
For the forest or domain to be operational, all the existing domain controllers must have the same OES version and the same patch applied. A new OES 2018 SP2 domain controller can be added to the existing forest only after all the existing domain controllers are upgraded to OES 2018 SP2.
It is recommended to perform upgrade in the following order in a forest:
Within the domain, upgrade the Primary Domain Controller (PDC) first and then upgrade other domain controllers.
Within the forest, upgrade the Forest Root Domain (FRD) first and then upgrade the child domains.