Attempting to join a domain with a 2012R2 functional level should give a clear error message and describe the available options Here's a snippet of what we get when we try: Joining Samba4 (v4.8.5) to a Win2kr2 domain gave this error (among others): DsAddEntry failed with status WERR_ACCESS_DENIED info (8567, 'WERR_DS_INCOMPATIBLE_VERSION')
*** This bug has been marked as a duplicate of bug 13619 ***
Sorry, didn't mean to mark this as the duplicate, this is a different facet of the bug, wanting a better error.