[Samba] Setting Win ACLs via Comp Managment, connection to Member Server warning

[Lin Pro]

I have given the SeDiskOperatorPrivilege on the domain member but it
did not help. The connection warning persists when I click on the
"Shared Folders" + shared. It says to check network path, firewall
rules. dismissing the window takes me to the domain member and shared
folder can be selected and viewed. An attempt to modify and pressing
"apply" results in another warning that it is a root share and that
anything inherited will be removed and so on.

Question: What is the minimal set of Accounts that need to have UNIX
atributes set in order to have a functional domain?
(in my case I set Unix attributes on BUILTIN Administrators and Users,
SAMDOM\<myusers>.)

My setup is ADDC (ubuntu) + DM (Ubuntu). Trying to Administer eACL
from Windows Server 2012 R2 RSAT.

thanks
Lin