I use NAS4Free based server for all my file sharing needs. Give it a bit of ZFS turbo and you have a reliable setup.
However, I noticed one quirk if you will. From my computer I could execute installations located on the network share while my kids were greeted with "Windows cannot access..." error. Cause was clear. My kids had read-only access while I had full rights. And it was definitely that, as I could use chmod +x to make file executable and go on my marry way.
Doing it recursively over all directories would have solved the problem but not necessarily permanently as any newly created file would need the same adjustment. And yes, it would be possible to force inheritance of attributes from parent but that seemed overly restrictive - not even taking into consideration that my NAS4Free command line would suddenly auto complete every executable file in directory.
Fortunately, Samba 4.1 has a simple solution for it - acl allow execute always. This option than "fakes" executable attribute without setting it on the underlying system. It is as close as it gets to "have your cake and eat it too".
NAS4Free unfortunately doesn't have this option exposed to user. However, it does have free form field for configuration parameters. Solution is just finding Auxiliary parameters under Services, CIFS/SMB and adding acl allow execute always = true into a text box. Short restart later and any restricted Windows user will be able to execute files from the network share.
[2018-07-22: NAS4Free has been renamed to XigmaNAS as of July 2018]