samba - Sep 2004 - Modifying ACL's from client without using winbind

My situation is pretty simple but I'm not able to figure out this last 
bit (any help is greatly appreciated).  I have a Samba3 server that is a 
standard NT member of an Active Directory.  All domain user's have 
matching local accounts, and the domain groups that are involved also 
have matching local groups.

Clients can set permissions within the shares but are *unable* to add or 
remove users/groups from those acls.  Do I need to configure some kind 
of additional user or group mapping?

Thanks in advance,
Christian