Set correct parameters for domain controller role
It looks like a side-effect of the following commit was that we stopped adding
vfs objects = zfsacl zfs_spaceto the [sysvol] and [netlogon] shares. https://github.com/freenas/freenas/commit/fd84b41390e1b9dd93753da201c9325fe338f4fa#diff-142c75298569a3d6a5c1dcb5b7109845
We need to do this, and also add the following parameters on those shares in order to pass samba-tool ACL checks
In the absence of a "vfs objects" parameter, the share definition will inherit this parameter from the parent. This looks like it may be a bug in "samba-tool ntacl get" when the server is configured as a DC (or has vfs objects set globally). I didn't see this in 4.9 testing and so I think it's possibly already been fixed upstream.