Since "normal" Samba operations are working, this still smells like an issue where the client makes a request of the samba server and the samba server requires additional authentication before it can reply to the client, but times out trying to get that authentication. (But then, I thought that all authentication necessary took place in the session setup.)

For the user-private rw, which machine is controlling authentication? Are the samba servers each set up with identical sets of users (i.e. authentication through users stored in /etc/samba/smbpasswd (or passdb.tdb), created via smbpasswd), or is Samba configured to use winbindd, to look up authentication and UAC details from a Windows machine? And, if the latter, which machine serves up the user details?

Have you tried running wireshark, to see what's happening on the network? On both client and server?

The only other common thread I see, here, is that XP and Linux work, while it's Windows 7 that doesn't work. Maybe it's related to the protocol getting used? The former have no SMB2 support, while the latter can use SMB2 if the server is configured to use it. SMB2 has more security "features" for ACLs, so perhaps they're getting in the way. Are the Samba servers configured to use the SMB2 protocol? And if so, does the problem go away if you turn it off (remove the 'max protocol = SMB2' line)?

Does this problem only happen when you double-click the file in Explorer? Or does it also happen if you open the application first, then do File->Open (or the equivalent)?

Did the Win7 update change any settings in the UAC? What happens if you dial down/turn off the UAC settings?