[Samba] PDC Profiles - definitive perms

[Rob Mason]

Hi - I know this has been asked and answered dozen of times, but I can't
seem to locate an authoritative answer.

For a Samba-3 PDC supporting roaming profiles, which combination of
permissions will provide Windows-PDC roaming profile behaviour on the
[profiles] directory tree???

Typical examples give:

        path = /usr/local/profiles
	read only = no
	browseable = no
	create mask = 0600
        directory mask = 0700
        write list = @ntuser @wheel
	profile acls = yes
        hide files = /desktop.ini/ntuser.ini/NTUSER.*/

I understand this as read/write on user files, execute on directories,
with no access to group and world.  Is this correct, and will this work?
I keep getting problems with profiles (probably due to swapping
and changing permissions in order to get things stable) - what I really
need is an accurate baseline to start from. 

Rgds

Rob