Mac OS 10.4, Samba – Mismatch between server SID in Samba and Workgroup Manager

I have a Mac OS 10.4 XServe running AFP, DHCP, NetBoot/NFS, OD, and Windows services. It is both the Open Directory Master and PDC for about 50 Macs and Windows XP computers (mostly Macs). The only other windows server we have is a limited-use application server, and it isn’t responsible for any zone info or file sharing.

I’ve been trying to do a better job of managing the Windows computers, hobbled a bit from not using Windows that much, especially the server end.

Somehow I’ve got the server in a state where Windows XP computers cannot join the domain (computers that have already joined are okay and can login normally). We see the message “No mapping between account names and security IDs was done” which I tracked down to http://www.radiotope.com/node/61 (which doesn’t seem to be responding right now). The web page said I could have a mismatched server SID between Samba and the Workgroup manager — in other words the WGM has one value for the SID and Samba itself has another.

I checked, and this seems to be the case. In the WGM’s Inspector under CIFSServer and then XMLPlist there is one SID value, and samba’s “net getlocalsid [domain]” reports a different value.

From the comments on the website, I obviously need to get those two values to match. I see three different possibilities:

1) Create a new domain, have all clients drop the old domain and join the new one
2) Make Samba match the value used by the WGM
3) Make the WGM match the value used by Samba.

The problem and my question to you folks then is — what are the consequences of each action and what action is the “best” in terms of time to implement and risk of data loss for the clients (they have documents stored on the server, email settings, etc.).

Also — Is there a good “Managing windows computers using Samba” website or book?

Thanks,