Attempting to join a domain with a 2012R2 functional level should give a clear error message and describe the available options Here's a snippet of what we get when we try: Joining Samba4 (v4.8.5) to a Win2kr2 domain gave this error (among others): DsAddEntry failed with status WERR_ACCESS_DENIED info (8567, 'WERR_DS_INCOMPATIBLE_VERSION')