samba - Jul 2011 - printer preferences admin

Samba 3.5.9.  We have printers exported to Windows and have the following
options configured:

enable privileges = yes
load printers = yes
printing = cups
printcap name = cups
cups options = raw

[printers]
  admin users = @printer-admins
  comment = All Printers
  browseable = yes
  path = /var/spool/samba
  printable = yes
  public = yes

[print$]
  admin users = @printer-admins
  write list = @printer-admins
  comment = Printer Drivers
  path = /var/lib/samba/printers
  browseable = yes
  guest ok = no
  create mode = 2777
  root preexec = /usr/bin/renice +18 -p %d

and net rpc rights list:
..............................................
BUILTIN\Print Operators
No privileges assigned

BUILTIN\Account Operators
No privileges assigned

BUILTIN\Backup Operators
No privileges assigned

BUILTIN\Server Operators
No privileges assigned

BUILTIN\Administrators
SeMachineAccountPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeRemoteShutdownPrivilege
SePrintOperatorPrivilege
SeAddUsersPrivilege
SeDiskOperatorPrivilege

Unix Group\printer-admins
SePrintOperatorPrivilege
SeDiskOperatorPrivilege

Everyone
No privileges assigned
..............................................

Everything works great, including printing and installing printers on
clients, EXCEPT when members of @printer-admins go into the printer
properties via a Windows machine, all administrative options are grayed out.
 The only way I've determined that fixes this is to add @printer-admins to
the [global] admin users.  Having them as admin users under [printers] and
[print$] doesn't seem to do it, nor does the rights assignment.  Is this
expected?  Am I missing a setting?

From: Matt LaPlante <mattl at google.com>
Date: Wed, 27 Jul 2011 13:19:45 -0500
> Samba 3.5.9.  We have printers exported to Windows and have the following
> options configured:
(snip)
> Unix Group\printer-admins
> SePrintOperatorPrivilege
> SeDiskOperatorPrivilege
(snip)
> Everything works great, including printing and installing printers on
> clients, EXCEPT when members of @printer-admins go into the printer
> properties via a Windows machine, all administrative options are
> grayed out.
To map the printer-admins local (UNIX) group to any local or global
(Samba) 
and to give the proper ACL for the printer to this group from Windows,
this problem will be solved?

---
TAKAHASHI Motonobu <monyo at samba.gr.jp>