It is possible to set permissions also from Windows using SMB superuser, or operate on groups to minimize amount of ACLs entries.