Samba4 to Windows AD Clean-up Specialist , SERVER 2008

We have an Active Directory environment originally promoted on Samba4, later joined by Windows Domain Controllers. After promotions/demotions, the domain shows instability and health issues.
No running on 2008.

Symptoms include:

dcdiag failures (NCSecDesc – missing replication permissions on domain NC)

DomainDnsZones / ForestDnsZones missing msDS-SD-Reference-Domain

DNS dynamic update failures and SRV lookup instability

DC discovery inconsistencies

Legacy SYSVOL / replication metadata inconsistencies

Looking for an expert with real experience in Samba4 AD → Windows AD migration/cleanup, including:

Repairing AD security descriptors safely

Normalizing DNS application partitions

AD-integrated DNS troubleshooting

Replication topology verification and cleanup

FSMO readiness validation

This is not a “reinstall everything” job.
Remote access available. Documentation and logs provided.

Please describe similar work you have done.


Plan is to upgrade it to 2016
Immediate help needed.