I have a Samba 4.5.12 server on Debian 9 that is configured with extended attributes for enabling Windows clients to set permissions on folders with the standard Windows dialogs. I have a one on one user mapping from Windows to Samba.
I'm able to retrieve the Samba user list (from security->edit->add->advanced->find now) and give permissions to shared folders when I'm logged in as a Windows local administrator, but I get a dialog box asking for credentials when trying to do the same thing with a standard Windows user. I'm able to traverse folders and read/write on the server share though. I'm not able to give permissions even when I don't go to advanced but just enter the user name after "add" (I get a name not found dialog).
So, the question is, what extra permissions the standard Windows users need to get to be able to retrieve the user list from Samba and set folder permissions on the server?