When running on a Samba 4.7.7 ROLE_DOMAIN_PDC, the "testparm" tool outputs the following: idmap range not specified for domain '*' ERROR: Invalid idmap range for domain *! This is obviously targeted to a domain member and should not occur on a PDC. A check should be included in the tool to verify which server role it is being running on. See the resolved bug 12629 for the case of Samba as AD DC. https://bugzilla.samba.org/show_bug.cgi?id=12629 Thank you.