ShadowProtect does not modify the SID during a restore operation, so you will need to use some other tool to do this (post-restore), such as newsid, as indicated by bsdice.
This is usually only an issue for deployment of a single image to multiple clients on the same domain, IIRC.