We should have a diagnostic check for uidNumber/gidNumber values higher than the samba/winbind idmap range. Users with uid outside of the idmap range cannot access shares on memberservers.