I am not 100% clear as to when the following is required in smb.conf on a member server: vfs objects = acl_xattr map acl inherit = yes store dos attributes = yes https://wiki.samba.org/index.php/Shares_with_Windows_ACLs#Enable_extended_ACL_support_in_smb.conf I have confirmed Samba is compiled with ACL support: [root at centos7member ~]# smbd -b | grep HAVE_LIBACL HAVE_LIBACL [root at centos7member ~]#