I have a Samba 4 server running as a domain member sharing a bunch of document images that get updated regularly. I have the root folder of the share set up as owned by user "foo" and group "Domain Users" with "Domain Admins" having full control of the group. User "bar" creates new files and folders by copying files to the folder.
When user "admin1" (member of Domain Admins) tries to change or update security permissions on the new files, we get "access denied". When user "foo" tries (a member of Domain Users) tries to change the files, we also get "access denied". Even making sure that the files and folders are set to allow "Domain Users" full control, we still get access denied. It's like the group permissions are being ignored and only the user permissions are applied.
Am I maybe not understanding how Windows ACLs work?