Trying to set an ACL from scratch with smbcacls -S fails against Win2k3 :

houba$ /usr/local/ARCH/alpha5/stow/samba-3.0.22/bin/smbcacls -S "REVISION:1,OWNER:Administrateur,GROUP:Admins du domaine,ACL:Administrateur:ALLOWED/3/FULL" -U Administrateur //nfs2/Bureautique info/test
Password: 
NT_TRANSACT_SET_SECURITY_DESC failed
ERROR: secdesc set failed: NT_STATUS_INVALID_SECURITY_DESCR

After some debugging, it appears that the ACL version defined when creating the new ACL is incorrect -- the minimal patch below fixes the problem :

--- smbcacls.c.orig     2006-09-07 14:04:48.000000000 +0200
+++ smbcacls.c  2006-09-07 14:05:01.000000000 +0200
@@ -360,7 +360,7 @@
        SEC_ACL *new_ace;
        SEC_ACE *aces;
        if (! *the_acl) {
-               (*the_acl) = make_sec_acl(ctx, 3, 1, ace);
+               (*the_acl) = make_sec_acl(ctx, 2, 1, ace);
                return True;
        }