[Samba] failure view /edit access list on samba share.

[nzlx]

Hi,

I have samba server joined to ADS domain (Windows Server 2003 r2)
It seems it works ok besides I can't see right access mask and edit them
(if logged user is ownder of directory or file).

 smb.conf
   workgroup = CXX
   security = ads
   passdb backend = tdbsam
   realm = CXX.INTERNAL.COM

   password server = main

 [u]
 path = /mnt/u
 readonly = no
 browseable = yes
 acl group control = yes
 dos filemode = yes
 admin users = nz-adm


nmb is started as service, winbind doesn't.
there is mapping between unix groups and nt domain groups
users with the same name as nt domain usres are created in linux.

/mnt/u is mounted  with options acl,user_xattr.

The problem is
\\smbtest\u is opened on windows xp client
I can works with file ok according to posix acl on  /mnt/u
but in properties security tab
I see acl but all flags Read Write and ... etc is off
and if user is owner files I would like that he will be able to add new 
group
and and set read/write permission. It adds this but afte apply buttons press
this new added group is disappeared.

How to debug this problem? which log level to switch on?
all:10 is too much.

version samba-3.2.5-0.22.fc9.x86_64

Thank in advance.