Ideally you move completely away from AD. I've used Pgina before for alternative auth methods when you have to deal with a dozebox but it has major issues that

Ideally you move completely away from AD. I've used Pgina before for alternative auth methods when you have to deal with a dozebox but it has major issues that make it not worth it, so in reality you usually have a virtualized samba domain that pulls from FreeIPA (389 ldap underneath). (and if you have a windows admin on staff who can't write a GPO by hand you can virtualize the DC admin doze machine and ensure good rbac.)