If you switch and use ADS or PDC, users without a policy in the domain will not be allowed access.
Using ADS, or PDC makes DSS authenticate users via the domain controller.