Your problem probably comes from using the AD DC as a file server. The file server should be separated, as recommended by the Samba Wiki. I get close to wire speed on dedicated member servers. With version 4.4.2, changes in behaviour for the "server signing" and "client signing" parameters were introduced to address the Badlock bug. Please read the following, specifically the paragraphs relating to CVE-2016-2114 and CVE-2016-2115.
Possibly Parallel Threads
Wisdom of the Ancients
