Looks like it is not even documented on the samba website itself, or did I miss it?
Best hit I got is from: http://devarthur.blogspot.de/2008/05/integrating-ubuntu-hardy-heron-804-with.html
To get the SID of the a group use:
wbinfo -n "DOMAIN\group"
SID "S-1-1-0" is Everyone
The access modifiers after the group SID are as follows:
R - read-only F - full access D - deny access