[Samba] Still can't figure out ACL issues

[jimc]

Yah, jimc again.

I still cannot figure out what is wrong with my dc. The problem began 
with being unable to log on from Windows boxes after a power hit.

The initial symptoms were:

1) When I log in on a Windows machine, with an account that should have
administrator permissions, I don't have said admin rights.

2) When I attempt to launch the Windows remote server tools, I can
select the server, but when I attempt to connect I get the ever popular
'rpc server unavailable'.

3) When I run 'samba-tool gpo aclcheck', I get an uncaught exception
error (-1073741705) 'Indicates the ACL structure is is not valid'.
Followed, of course, by the unwinding call stack.

4) smbclient //localhost/netlogon -UAdministrator -c 'ls' nets me the
message:
'Domain=[ozco] os=[unix] Server=[Samba 4.3.1]
NT_STATUS_INVALID_ACL listing \*'

After much wailing and gnashing of teeth, I did a setfacl.

Now, 'samba-tool gpo aclcheck' returns "uncaught exception - 
(-1073741790 'access denied')".

I really would appreciate any help you can offer!

-jimc