search for: assigining

Hello, Since I updated recently my samba DC's, I've noticed some werid behaviour on windows stations (seems random?) with some GPO's not being applied from time to time (reboot or even logoff-login usually does the trick). When policy is not applied and I run "gpupdate" on windows client  I'm getting output, that policy xxx (Default domain policy) could not be

...sysvol rsynced to dc2 and dc3, they had messed up mappings - copying idmap.ldb from DC1 again solved this issue. So question: how can You prevent such scenario? Are you supposed to periodically "sync" idmap.ldb from one DC to others to keep mappings in order? Is using RFC option for assigining UID/GID the only way? Regards, Kacper