I've recently been dealing with permissions that keep changing to an objectSid. This is only reported in DFS GUI as I'm able to run the cmd "dfsutil property acl \\dfsroot\share" on the server and it returns the correct group names instead of the generic sid seen in the gui (S-1-5-21-<domain>-2). I've looked here (http://msdn.microsoft.com/en-us/library/cc980032.aspx) and don't see the appended "-2", by itself, anywhere. I also knew I wouldn't find it anyways due to the fact that this is occurring on multiple folders under the namespace and giving the same objectSid each time... All machines having this issue are new 2008 R2 SP1 boxes with a new 2008 namespace. I've also applied the hotfix http://support.microsoft.com/kb/2464365 to these boxes with no change in behavior.
SysAdmin Bryan Ciaraldi