I know this thread is about windows acl's, but do the various samba options help? For instance, I set umask on one of my shares to that files / directories always get created with g+w, even when the client doesn't specify group write access. I'm not sure if you can do similar with windows acl's.