I found a possible solution/workaround to exception on windowssignin.aspx - at least on our intranet.  I happened to notice that on one machine my shortcut to windowssignin.aspx worked and on another machine it caused an exception.  The difference was that one was to the machinename and the other was to the fully qualified name with our domain name on it.  The site itself did NOT HAVE both of those formats in the alias table (Host, Portal, edit, Portal Aliases).  I added the one that was missing (with the FQDN) and the error went away.  Just a data point for you. 

Yesterday I duplicated the problem with 1.0.4 removing users from DNN groups with names matching the AD group.  I'm going to roll back to 1.0.3 today if we can't get role sync to work under impersonation.  We have some old DLLs in the bin folder from 3rd party modules that are no longer installed, and when we turn on impersonation, they cause compilation to fail.  We're going to rename them, but only have a small window to test today.

Roberta