How to set permissions for a Samba resource from Windows?

Question

System administration

There is a certain file Samba-server which is entered into the domain and at which the folder is shared. When I try to change from Windows in the "Security" tab the access settings for files or folders inside the Samba share, Windows shows an error that they say "Error applying security settings. Access denied". Also, it is not possible to connect through the Windows snap-in to the Samba resource in order to set the rights of the balls themselves.
I do everything as in this article.
The Samba server was configured as standard according to this article and this answer.
Tell me what I'm doing wrong ... The config is as follows:

[global]
security = ADS
workgroup = DOMAIN
realm = DOMAIN.RU
dedicated keytab file = /etc/krb5.keytab
kerberos method = dedicated keytab

idmap config * : backend = tdb
idmap config * : range = 2000-7999
idmap config DOMAIN:backend = rid
idmap config DOMAIN:schema_mode = rfc2307
idmap config DOMAIN:range = 10000-999999
idmap config DOMAIN:unix_nss_info = yes
template shell = /bin/bash
template homedir = /home/DOMAIN.RU/%U

winbind enum groups = Yes
winbind enum users = Yes
winbind use default domain = Yes
winbind refresh tickets = Yes
winbind offline logon = Yes
winbind normalize names = Yes
winbind expand groups = 4
winbind nss info = rfc2307

vfs objects = acl_xattr
map acl inherit = Yes
inherit permissions = Yes
inherit acls = Yes
store dos attributes = Yes

unix charset = UTF-8
interfaces = 127.0.0.0/8 eth0
bind interfaces only = Yes
name resolve order = bcast host
dns proxy = no

domain master = no
local master = no
preferred master = no
os level = 0
domain logons = no
load printers = no
show add printer wizard = no
printcap name = /dev/null
disable spoolss = yes

log file = /var/log/samba/%m.log
log level = 1

[exchange]
path = /var/exchange
browseable = yes
read only = no
valid users = @"пользователи домена"
admin users = @"администраторы домена"