If your Samba member server is still using idmap_ad, after the DCs get updated, you may lose SMB authentication or even lose the ability to map AD-supplied identities to Unix accounts properly. Switching from idmap_ad → idmap_rid or another backend will change how UIDs/GIDs are assigned. This can break file permissions, ACLs, or cause mismatches if you already have files owned by users via the old mapping. Some users report that after switching, all users and groups essentially get new IDs, and previous ownerships are “lost” (effectively) unless remapped