Steps to Reproduce:
===================
In Windows
1) create testuser1, testuser2 in domain
2) create testfolder in share
3) open security tab of testfolder
4) add testuser1 with read only permission, click apply and close
5) verify ace is set by reopening security tab of testfolder
6) delete testuser1 from domain
7) log off and log back on (might need to restart to clear windows cache)
8) open security tab of testfolder
9) verify ace entry exists with windows SID displayed (SID belongs to deleted testuser1)
10) without deleting the bad/stale ace, add testuser2 with read only permissions
11) click apply and close, new ACE entry will not be saved

seems to be samba issue. 
same steps works for native NTFS files system