diff --git a/roles/ipaserver/library/ipaserver_test.py b/roles/ipaserver/library/ipaserver_test.py
index 2158150556184adcbcadf204735ff78c33c00917..f830f37d8a3660815c1a3bc805c7bab23cffaab4 100644
--- a/roles/ipaserver/library/ipaserver_test.py
+++ b/roles/ipaserver/library/ipaserver_test.py
@@ -225,7 +225,8 @@ from ansible.module_utils.ansible_ipa_server import (
     read_cache, ca, tasks, check_ldap_conf, timeconf, httpinstance,
     check_dirsrv, ScriptError, get_fqdn, verify_fqdn, BadHostError,
     validate_domain_name, load_pkcs12, IPA_PYTHON_VERSION,
-    encode_certificate, check_available_memory, getargspec, adtrustinstance
+    encode_certificate, check_available_memory, getargspec, adtrustinstance,
+    get_min_idstart
 )
 from ansible.module_utils import six
 
@@ -579,6 +580,16 @@ def main():
                     "'--ignore-topology-disconnect/--ignore-last-of-role' "
                     "options can be used only during uninstallation")
 
+            if get_min_idstart is not None:
+                min_idstart = get_min_idstart()
+                if self.idstart < min_idstart:
+                    raise RuntimeError(
+                        "idstart (%i) must be larger than UID_MAX/GID_MAX "
+                        "(%i) setting in /etc/login.defs." % (
+                            self.idstart, min_idstart
+                        )
+                    )
+
             if self.idmax < self.idstart:
                 raise RuntimeError(
                     "idmax (%s) cannot be smaller than idstart (%s)" %
diff --git a/roles/ipaserver/module_utils/ansible_ipa_server.py b/roles/ipaserver/module_utils/ansible_ipa_server.py
index aba6b68a393de19ca5180e40d119cdaf49cfdec6..5b1c4e5de07b48618263affff81e925ce28e5aed 100644
--- a/roles/ipaserver/module_utils/ansible_ipa_server.py
+++ b/roles/ipaserver/module_utils/ansible_ipa_server.py
@@ -41,7 +41,7 @@ __all__ = ["IPAChangeConf", "certmonger", "sysrestore", "root_logger",
            "adtrustinstance", "IPAAPI_USER", "sync_time", "PKIIniLoader",
            "default_subject_base", "default_ca_subject_dn",
            "check_ldap_conf", "encode_certificate", "decode_certificate",
-           "check_available_memory", "getargspec"]
+           "check_available_memory", "getargspec", "get_min_idstart"]
 
 import sys
 
@@ -200,6 +200,11 @@ else:
             from ipalib.x509 import load_certificate
             load_pem_x509_certificate = None
 
+        try:
+            from ipaserver.install.server.install import get_min_idstart
+        except ImportError:
+            get_min_idstart = None
+
     else:
         # IPA version < 4.5