samba - Aug 2010 - create_canon_ace_lists: unable to map SID

I did search and found other folks with this issue but I didn't see a
solution to my specific issue:

I am running Samba 3.4.7 on ubuntu 10.04 LTS server configured to
authenticate to active directory via Kerberos and LDAP for use with clients
from OS X and Windows (no linux clients)
On the advice of my local active directory team Winbind has been uninstalled
and everything works nicely except except for not being able to set ACLs
from the windows properties security tab.
When I add a new user it shows fine in the security tab until I press apply
at which point the newly added user disappears and the on the samba server
the log shows:

 smbd/posix_acls.c:1711(create_canon_ace_lists)
  create_canon_ace_lists: unable to map SID
S-1-5-21-503695880-695175589-3595387526-10512 to uid or gid.

I can set and get  ACLs from linux command line on the samba share files OK
using setfacl and getfacl and those settings can be seen OK in the windows
properties security tab and I have all the recommended ACL settings in
smb.conf.
getent passwd and getentgroup return the AD groups and users correctly.

I read a mention of something similar here:
http://help.lockergnome.com/linux/Samba-Samba-LDAP-error-windows-xp-ACL--ftopict509241.html


but it is not clear to me from my searches or reading the documents on
http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/<http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/AccessControls.html#id2613465>
if
I must have winbind enabled to allow setting ACLs from windows.

Is winbind required for setting ACLs from windows?

Here's my smb.conf for reference:

[global]
  unix extensions = no
  disable spoolss = Yes
  name resolve order = hosts
  workgroup = AD
  realm = AD.MYDOMAIN
  server string = %h server (Samba, Ubuntu)
  dns proxy = no
  log file = /var/log/samba/log.%m
  max log size = 1000
  syslog = 0
  log level = 0
  logon home = ""
  logon path = ""
  panic action = /usr/share/samba/panic-action %d
  security = ads
  encrypt passwords = true
  passdb backend = tdbsam
  obey pam restrictions = yes
  unix password sync = yes
  pam password change = no
  map to guest = bad user
  usershare allow guests = no
[asgs]
  comment = ASGS
  path = /shares/asgs
  browsable = Yes
  valid users = @ad\ASGSFileUsers
  write list = @ad\ASGSFileUsers
  create mask = 2660
  force create mode = 0660
  directory mask = 2770
  force directory mode = 0770

and here's nsswitch.conf
passwd:         files ldap
group:          files ldap
shadow:         files ldap
hosts:          files dns
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis

and my pam.d/samba
@include common-auth
@include common-account
@include common-session
auth required pam_unix.so nullok_secure
auth sufficient pam_krb5.so minimum_uid=1000 use_first_pass
account sufficient pam_ldap.so use_first_pass
session sufficient pam_ldap.so


Thanks for your insight.

Grant